How to detect a vulnerability on a website?

Question

CMS

The site becomes infected - virus files and folders appear in the root and other folders. How to determine where the first file appeared, that is, the source of infection? Can somehow on logs it is possible? The dates of the creation of virus files are varied and cannot be traced.
I understand that there may be different vulnerabilities for different CMS, but the very principle of finding the entrance for the virus is interesting, from which folder / file it all started.

Answer 1

Run it with Aibolit
Update the CMS version
Then run it again with Aibolit
PS And why did you decide that the first file is one?
Who prevents the virus from registering immediately in 10 folders.
And the entry point can be any php code in the database, executed via eval.

Answer 2

The vulnerability may not be in the CMS. Especially if some LAMP was configured according to the precepts of Digital Ocean.