I have a system that uses openx for serving banners. I have recently noticed that several cache file in /var/cache contain infected code. The code contains sql queries that create several php files in the filesystem. These files are web shells that contain code that enables an attacker to execute operation system commands on the openx server. My problem is I have no idea how the cache is infected. I am ignorant as to how new files are created in the cache and how an attacker can control their content. Is anyone familiar with this situation or can point my in the right direction?

ultimately I intend to upgrade my openx version but as part of my forensics it is important for me to understand what was the attacker's modus operandi?

  • what version are you using?
    – tim
    Feb 22, 2015 at 19:02
  • I am using version 2.8.7 Feb 22, 2015 at 19:38
  • I did not find any specifics on the scenario you are describing, but you should definitely update. Earlier versions of openX are vulnerable to LFI, CSRF, XSS, SQL injection, have a backdoor, and open redirect vuln, among others.
    – tim
    Feb 23, 2015 at 10:43

1 Answer 1


OpenX Ad Server version 2.8.10 was shipped with an obfuscated backdoor since at least November 2012 through August 2013, remove and install a fresh version of OpenX.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.