Because of insecure handling of uploaded files, an attacker was able to run php code on my server (CentOS 5.4) That issue has been fixed, but while he was connected he appears to have modified a file which was owned by root (file perms 644), replacing it with one owned by the apache user. Are there apache or php exploits out there which could have enabled this?
In response to the first comments which request more information - it would have been bad enough for the attacker to be able to upload files to my server and perhaps send users to malicious content on my domain. However, he/she was also able to edit files. The result of this was that my website was modified in such a way as to email all info from new user registrations to a gmail address.
I am not sure where to start looking, and am requesting help in this. Other than the obvious directory permissions (do not permit file upload to directories where php code may be executed; do not execute php code in users' upload directories) I don't know what to change to ensure this cannot happen again. It was my understanding that if a file was owned by root, no other user could change it. Obviously this was not true.
If it was your server, where would you look?