Empty Issues Vol. 99 No. 98 (2024): Lanciau POC for many journals ojs 3.3

[aszhokhin]

OJS 3.3
Try a Google search for doi 10.56727/bsm.v8i1
https://www.google.com.ua/search?q=10.56727%2Fbsm.v8i1+&sca_esv=248c1a1232d6ce85&sxsrf=AHTn8zowfRJsWoq_bZ6zEyT-K8GaMaTDqA%3A1741536420895&source=hp&ei=pLzNZ5uLNL6Sxc8PufOw0QQ&iflsig=ACkRmUkAAAAAZ83KtIUQ093qoojXg7USZEOP4lOCYfeX&ved=0ahUKEwib7endsP2LAxU-SfEDHbk5LEoQ4dUDCBg&uact=5&oq=10.56727%2Fbsm.v8i1+&gs_lp=Egdnd3Mtd2l6IhIxMC41NjcyNy9ic20udjhpMSBIuwRQAFgAcAB4AJABAJgBU6ABU6oBATG4AQPIAQD4AQL4AQGYAgCgAgCYAwCSBwCgB0Y&sclient=gws-wiz

What is this a bag?

[asmecher]

Hi @aszhokhin,

See:

Publishing fake issues in third-party OJS (without hacking into OJS)

Complementing the general case with our findings: We did not identify how they obtained the credentials of legitimate users, but we were able to identify a pattern of similar attempts in this and other journals: Log in with a regular journal user They try to access the XML import area If there is no permission and there is another compromised login in the same OJS, they restart the process. Now specifically about the case where they succeeded in publishing an issue, and which I reported abov…

Regards,
Alec Smecher
Public Knowledge Project Team