Phishing mails being sent from OJS site

[shahul]

Dear all,

Our journal site which uses OJS is sending out large quantities of spam, phishing mails. I changed the control panel password and email password, and upgraded to 2.4.8-1, but the problem still persists.

First, I get this mail: “This is a test email sent using Email Sender Deluxe. If you received this email, then your email account setup is working.”

Then the phishing mails start flowing.

I contacted my hosting provider, and they asked me to remove any “inbuilt mail sending scripts”.

Is this likely to be an OJS issue? If yes, what to do to solve this?

Thanks in advance.

[asmecher]

Hi @shahul,

It sounds like someone is installing a PHP email sender on your server. I’d suggest starting by checking this thread:

Security issue: Hacking via submission in OJS 2.4.8

Hi @Roumen_Anguelov , I’ll need more information in order to determine what’s happened – can you provide more details? One known vector that has been used to attack OJS installations is to take advantage of a common misconfiguration in the files directory. Is your files directory accessible directly via the web server? If so, then it’s possible for authors to upload malicious files (e.g. PHP scrips) and then invoke them by requesting them directly from the submissions directory via the web ser…

Regards,
Alec Smecher
Public Knowledge Project Team

[shahul]

Thanks for the prompt response. The issue seems to be in the files directory. mysite/files returns a page which says “hacked by ./Coco || contact me : handokofuji@gmail.com” . Shall follow the steps detailed in the thread you suggested, and get back.
Thanks once again.

[asmecher]

Hi @shahul,

Leaving your files directory web-accessible is a known attack vector; review the “Recommended Configuration” section of docs/README.

Regards,
Alec Smecher
Public Knowledge Project Team

[shahul]

Thanks a lot, and apologies for not paying attention to that aspect before.

I am not an expert, and hence please clarify a doubt. I moved the files directory from outside the “public_html” folder to the root folder of the server. Now, how do I enter the path in config.inc.php ? (Previously it was files_dir = files ). Or, would it be better to keep the files directory in the public_html itself and change the permissions? If yes, what permissions should I allot to the folder?

Also, in the files directory, there is a folder named scheduledTaskLogs . Is it created by OJS, or could it be work of the hacker?

Thanks in advance.

[ctgraham]

The reference to your files_dir in config.inc.php can be a relative or an absolute file path. For example, it could be something like:
files_dir = /user/home/myuser/ojs_files
or
files_dir = ../../files

The scheduledTasksLogs folder is created and managed by OJS.

[shahul]

Thanks a lot for both the responses.

• Shahul.

[shahul]

I solved the issue with the inputs from both of you!