Codeigniter Code Injected in Index.php

I have a

Code:

codeigniter

project and I see the

Code:

index.php

page keep getting hacked :-
Some code is added automatically every time on the top of the index.php page and my site is redirect on third party url whenever i click anywhere
The injected code as follows :

Code:

error_reporting(0);
ini_set("display_errors",0);
include_once(sys_get_temp_dir()."/SESS_48cd7517d21176f980daa5502d9efb31");

How can I prevent this?

Most likely your project (either some functionality you created inside codeigniter or some plugin) allows a user to upload a malicious php file to some writeable location inside your document root. Think in the lines of uploading an image without a file extention check, or a script that caches/rips images or other files from oither domains and places it on your server, an outdated wysywig editor with broken upload capabilities etc.

That uploaded script (example yourdomain.com/tmp/badscript.php) gets called externally and injects the malicious code into your index.php.

To trace where your badscript is located you could check your access logs for any strange requests, or download all the files localy and try to search within the files for a string like "include_once(sys_get_temp_dir()".

After that you can figure out how badscript.php got uploaded in the first place and fix the issue.

A quick "solution" would be to disable executing php files all together except for index.php, edit your .htaccess:

Code:

Order Deny,Allow
Deny from all
Allow from 127.0.0.1

<Files /index.php>
   Order Allow,Deny
   Allow from all
</Files>

Your security issue wont be fixed but it will stop the malicious script from getting called and infecting your index.php again. It should give you some time to properly fix the issue itself.

Also make sure that your index.php file is set to chmod 0644 this only give the owner of the file write access.

What did you Try? What did you Get? What did you Expect?

Joined CodeIgniter Community 2009.  ( Skype: insitfx )