Webshell, how one uploaded file hands the server to strangers
Of all the kinds of flaws, there is one I fear most: the ability to upload your own PHP file to the server. Because that is not "swapping some text", it is letting in foreign code that does whatever it wants.
How it works
The site has a file upload field, an avatar, a form attachment, a photo for a gallery. If it does not carefully check what is being uploaded, the attacker slips in a PHP file instead of an image. Such a file is a so-called webshell, a small control panel through which the stranger browses files, reads the database, creates accounts and sends spam.
That is exactly what the well-known flaw in the File Manager plugin looked like: uploading a file without logging in and a full takeover of the site within hours.
Why it is so persistent
Webshells are quiet and they multiply. After a break-in the attacker leaves several of them in different places. Remove one and the rest remain, and through them it comes back. This is the main reason a "cleaned" site is infected again a week later.
What protects you
- Updates: flaws in upload fields are bugs in specific plugins.
- Blocking PHP execution in the uploads directory: even an uploaded file will not run.
- File integrity scanning: detects new, foreign files.
- Removing unnecessary plugins with a file upload feature.
Finding every webshell and closing the door is a job for someone who does it day in, day out. If you suspect an infection, reach out before it comes back.