injection attack (I thought I was protected!) <?php /**/eval(base64_decode( everywhere

Question

I've got a fully custom PHP site with a lot of database calls. I just got injection hacked. This little chunk of code below showed up in dozens of my PHP pages.

<?php /**/ eval(base64_decode(big string of code....

I've been pretty careful about my SQL calls and such; they're all in this format:

$query = sprintf("UPDATE Sales SET `Shipped`='1', `Tracking_Number`='%s' WHERE ID='%s' LIMIT 1 ;",  
 mysql_real_escape_string($trackNo),
 mysql_real_escape_string($id)); 
 $result = mysql_query($query);  
 mysql_close();

For the record, I rarely use mysql_close() at the end though. That just happened to be the code I grabbed. I can't think of any places where I don't use mysql_real_escape_string(), (although I'm sure there's probably a couple. I'll be grepping soon to find out). There's also no places where users can put in custom HTML or anything. In fact, most of the user-accessible pages, if they use SQL calls at all, are almost inevitably SELECT * FROM pages that use a GET or POST, depending.

Obviously I need to beef up my security, but I've never had an attack like this and I'm not positive what I should do. I've decided to put limits on all my inputs and go through looking to see if I missed a mysql_real_escape_string somewhere. Anybody else have any suggestions?

Also, what does this type of code do? Why is it there?

Answer 1

As a matter of fact, SQL injection is not the only type of attack your server may suffer.

And this one doesn't looks like SQL injection.

Most of time it's just a trojan horse at your PC, stealing FTP password.

to see the actual code, replace eval with echo. But I doubt it has anything interesting

Answer 2

That could have been caused by any common attack that have compromised the server.

Normally it is caused by an LFI (Local File Inclusion) but it can be caused by anything.

You can read more about LFI from:

http://labs.neohapsis.com/2008/07/21/local-file-inclusion-%E2%80%93-tricks-of-the-trade/

Hope it helps (a little)