How can a hacker put a file on my server root (apache, php, 1and1)

Question

Hi there, I have a site hosted on 1and1 and a couple of weeks ago I noticed a hacker had put a .php file on the server that when viewed in a browser exposed my DB schema, DB connection strings, FTP account (for file uploads using a form), etc, etc. Naturally I panicked and I wiped the server and reuploaded my files. Fortunatley I encrypt passwords using MD5 and I don't store things like credit card details, etc, etc.

Now I checked my files and with all user input I use a clean function (htmlentities, sql_real_escape_string, etc, etc) that strips the input of any XSS or SQL injection. I have also made sure that the session key gets re-engineered when a user status changes (like they log into their account) to prevent session hijacking, my folder permissions are set to 755 and file permission are 644.

Has anyone got any idea how this could have happened? Or if I'm missing something

Answer 1

the most usual cause is trojan horse that steal passwords from the FTP client on the developer's PC.

Answer 2

One option is through an upload script of some kind, for example I have see poorly protected image upload scripts allow this behaviour. I've actually seen this once in a script that resized images on the fly but used GET variables for the location of the image to resize. Its also worth checking any usages of exec() or system() for possible weaknesses. If its possible to access your server via SSH you could also check all commands run recently using the command history