site has been running fine lately,
until today, when i tried to login into restricted area of website & got an exception thrown.
User.php > namespace has to be the very first args
downloaded the file locally using filezilla & found this on top of User.php
rest all the php files seem to be intact, looks like hacker couldn't inject any further.
restored old User.php form my dev machine & site is back online again.
how could this injection be possible? i am not using ajax for logging in. just plain php.
do i need to worry?
Could be many different things and more than likely none of them related to laravel.
But yes you should be concerned. It is possible that malicious code on the server did that.
The fact there is an eval in there is very bad news.
There is no way to tell from what you've said so far how this piece of code got in there. Could be anything. They could have come in through unrelated services and modified that file. Is User.php writable by the webserver user?
Sign in to participate in this thread!
Laravel
Laravel News
Laracasts
Laravel Podcast