Topic: SME9 qMail security not working

[holck]

Hopefully you can find some information by looking through the httpd logfile in /var/log/httpd/access_log . You should be able to locate a suspiciously high activity for certain script files.

[Rudi]

i have implemented tinymce on one installation and it seems like this was it:

oerv.at 109.228.28.29 - - [24/Jul/2014:08:58:38 +0200] "POST /control/assistenten/tiny_mce/plugins/searchreplace/js/config.php HTTP/1.1" 200 3963 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.7.6)"

some 1000s lines like this i found

[Stefano]

search with Google, it knows (almost) everything

[Rudi]

well it seems that tinyMCE had an exploit somewhere ..
but they put the lid on it ..