I've been struggling with malware iframe injections into html and php scripts on my web site. The attacker knows to inject into files like header.php in the includes directory.
The file protections ARE locked down. In fact I have it so locked down I have difficulties doing normal duties myself and have to relax protection then restore it after I'm done (like on header.php. The Hacker can even change protection on files !!!
Finally I locked PHP from being able to write any files. And no more attacks.
The only PHP code I have is UBB Forum 7.2.2 !!!
The hosting company (host excellence) has a scanner script that gives warnings in tons of UBB php files. Like those at the bottom. Note sure if this is a valid warning or not.
Things are otherwise running smooth but I'll upgrade to latest version if known security issues are fixed.
FYI Found eval( in mydomain.com/ubbthreads/importers/classic_import.phpskip:
'\t@eval( $g_file );'
FYI Found eval( in mydomain.com/ubbthreads/importers/classic_import.phpskip:
'\t\t @eval( $hits_file );'
FYI Found eval( in mydomain.com/ubbthreads/importers/classic_import.phpskip:
'\t@eval( $mods_file );'
