I created several websites where some directories are set to the permission 755 and set the owner to "www-data" and group to "www-data".
This is so that I could prevent setting permisson to 777 for those directories and still make them writeable by the webserver for stuff like cache files, user uploads etc.
What I think after some log research is that the hacker scanned my server and found files with those exact permissions and the where able to edit these files and inject code into them.
It seems my method is VERY insecure since these websites are very different in terms of which applications runs on each website. That makes me think it is not a particular upload script that is insecure, but more something to do with my permission setting.
- Server OS: Debian Lenny
- Webserver: Apache 2.2
- Programming: PHP 5