Phishing mails being sent from OJS site

[asmecher]

Hi @shahul,

It sounds like someone is installing a PHP email sender on your server. I’d suggest starting by checking this thread:

Security issue: Hacking via submission in OJS 2.4.8

Hi @Roumen_Anguelov , I’ll need more information in order to determine what’s happened – can you provide more details? One known vector that has been used to attack OJS installations is to take advantage of a common misconfiguration in the files directory. Is your files directory accessible directly via the web server? If so, then it’s possible for authors to upload malicious files (e.g. PHP scrips) and then invoke them by requesting them directly from the submissions directory via the web ser…

Regards,
Alec Smecher
Public Knowledge Project Team