Help find php vulnerability

Question

PHP

Hi all!
Can you please tell me where to find a description of the php vulnerability, in which it was possible to view the contents of the php file?
Searched until two in the morning, tormented. I remember that there was an article on Habré.
ps. I'm helping a friend with a hacked site. The expolites seem to have been removed, but the infection still reappeared. It is written to the database as if from the admin panel. I have a suspicion that it somehow gets the connection parameters in config.php (someone wrote the engine on their own, so this file is still available from the outside, I'm already redoing it, but it's interesting).

Answer 1

In a more or less normal system, it is impossible to write to the database, even knowing the login password, since the ip address of a specific server (s) is specified when connecting to the database.

Yes. Only now, most sites are spinning on hosting sites, and not on GVA / VPS from site owners.
Knowing the login and password to the database:
1. We look at the entries where the domain (NSy) refers. In 99% it will be a hoster.
2. We go to the hosting, we look at the fact how to get to phpmayadmin (if it's myskul). In 98%, the link to it will be freely available from the hoster itself. Or it will be Googled in 3 minutes.
3. Do whatever you want in the database.

Answer 2

Hosting virtual, VPS or physical server?

Answer 3

It can also be sql injection and much more... To know for sure, you need to grep logs for a couple of hours...
In a more or less normal system, it is impossible to write to the database, even knowing the login password, since the ip address of a particular server is specified when connecting to the database ( ov). Allowing access from everywhere is 99% unnecessary.