Got Hacked - Anyone know what this PHP Code Does?

Question

Our server got hacked via some SQL Injection method (now patched). All our PHP files got this added to the very top of each file.

global $sessdt_o; if(!$sess         


        

Answer 1

First it sets a cookie. (named lb11) to the value 102.

If it (later?) finds the cookie, it sets the cookie to a random value between 1000 and 9000, so that it doesn't do this again: Has the user request (and execute) a javascript, which sends which which infected URL made the call, and then refresh the page, (so nothing appears to have happened after the javascript has run.

But in any case, if the "showimg" parameter is passed to the page, it looks at the content of that page, and executes it on the server.

So, If this code is present, it will run javascript, (which also informs the server which URL is infected, and then let the person run arbitrary code (via the showimg parameter) on the infected server.

This has 2 layers of attacks, it can attack the client with javascript, and can later attack the server and run arbitrary code on it.