My Yii2 web was injected with code

Yii 2.0 General Discussions
1

My yii2 app was injected with additional code in web/index.php like below.

<?php
echo "Zoroo";
// comment out the following two lines when deployed to production
defined('YII_DEBUG') or define('YII_DEBUG', true);
defined('YII_ENV') or define('YII_ENV', 'dev');

It caused all json response page is invalid and captcha is not displayed and may be a few more which I don’t notice. I don’t know the reason behind this hack caused by Yii, Web Server or etc.
Do have any idea to avoid this attack again ? TQ

2

Please explain your problem. Those line are mostly useful in debug mode and causes no issue other than activating debug/dev time features.

You must have an issue somewhere else with your code!

3 
echo "Zoroo";

Intereting stuff. Either you have your credentials leaked or there’s something that’s writing input into a file path to which is customizable and isn’t validated.

4

Missed this out. I thought he was complaining about the dev lines.
If he didn’t write the Zoroo thing then he better find a capable person to audit his environment

5

I think most possibly is writing input into a file path. Can you elaborate further about this ? TQ

6

The line echo “Zoroo” was written by hacker without my notice.

7

Then your file system is compromised. index.php should ONLY be readable not writable

1 Like