How to find malicious code on opencart?

Question

PHP

on the site in the basement there is such a thing joxi.ru/1A5ZpBki96L9rE , I dug everything in the template itself, there is nothing suspicious anywhere, then I noticed that when you go to the admin panel, there is also such a basement. Question: where in opencart can I find the code that displays such a dirty trick on all pages of the site?

Answer 1

1. footer.tpl + footer.php
2. Search in the whole project + search in the database

Answer 2

This code doesn't have to be in PHP. It can also be in JS files

Answer 3

Maybe this is happening with the help of js?

Answer 4

A similar infection was located in /system/library/response.php
The line

$ouput = eval(base64_decode('[множество символов]');

and is malware.
The original file should instead have echo $output;
In general, a lot of malware uses base64_decode, so you can search for this expression.

Answer 5

Comrade, you are very similar to a warez lover! We remember and look at the module downloaded in the wrong way. As nevamind wrote, we are looking for a similar code. If you say that when you enter the admin panel. look at /admin/template. If this thing does not interfere in principle, close it from the index and set redirect to the main one.