Hacker able to install plugin and change content in the server rootkitninja ojs 3.4.0.5

[asmecher]

Hi @tecnicouncoma,

If a rootkit was installed, then you won’t be able to trust the contents of your web root. It’s possible that additional PHP code was introduced there.

The parts of OJS that live in the web root are the source code, configuration file, and public directory. The source code will not be carried across with an upgrade to 3.3.0-20, so you’ll be starting clean there. Review the configuration file and contents of the public directory and ensure they are legit (e.g. free of executable code).

The contents of the files_dir (see config.inc.php) should live outside the web root and are not susceptible to remote execution.

See this thread for some additional guidance:

Preventing Vulnerabilities in the OJS 3.3.0-20

Hi @srht, Earlier releases of OJS 3.3.0-x were vulnerable to some stored XSS attacks, and we’ve heard reports that these have been used to escalate privileges via stored Javascript that gets presented to the manager or site admin. We’re not aware of any of these vulnerabilities in OJS 3.3.0-20 – but here are a few things to check if you did suffer a hack on a previous release. Some of this would apply to any PHP application, and you might find other helpful info on e.g. StackOverflow. If you…

Regards,
Alec Smecher
Public Knowledge Project Team