I recently had a breach on my site (laravel). I got aware of it after I tried to pull the code from github and found out that some files were modified.
The files modified were mostly storage - logs/cache and index.php had error_reporting(E_ALL) in it.
And I am not sure what happened and like to know if there's a way an attacker can access the server through the site and also what precautions I can take to mitigate these kinds of scenarios.
I researched a little bit and found out about these methods. Can anyone explain which method could possibly give access to an attacker to actually modify code files:
Cross Site Request Forgery - I dont understand much about how this works.
Cross Site Scripting - There are very less users using the site at this point and authorization & authentication is in place.
Local File Inclusion - Laravel uses namespaces and no such inclusions is made directly is it still a concern then?
Remote File Inclusion - Laravel uses namespaces and no such inclusions is made directly is it still a concern then?
Session Hijacking - PHP Sessions were not in use as it was a api based service and used jwt token
Session Identifier Acquirement - PHP Sessions were not in use as it was a api based service and used jwt token.
SQL Injection - All the db queries uses laravel eloquent so there might be no sql injection.