Modx evolution bug

Hi,
I have received bellow message from my hosting regarding sending spam please advice me.
During routine monitoring our server found your addon domain yorkshirepcrepair.co.uk due to spamming on server under your main account selectionsrestaurant.com, we have suspended your doman, please check provided logs, I have disabled following causing path

/home/selectio/public_html/yorkshirepcrepair.co.uk/manager/media/rss/




2014-08-08 01:15:16 cwd=/home/selectio/public_html/yorkshirepcrepair.co.uk/manager/media/rss 4 args: /usr/sbin/sendmail -t -i [email protected]
2014-08-08 01:15:16 1XFXq0-0005ZV-5J SMTP connection outbound 1407456916 1XFXq0-0005ZV-5J selectionsrestaurant.com [email protected]
2014-08-08 01:15:16 1XFXq0-0005Zi-6p <= [email protected] U=selectio P=local S=942 T="Heh Cuckold Husband Watches Wife take a BBC" for [email protected]
2014-08-08 01:15:16 1XFXq0-0005ZQ-3l SMTP connection outbound 1407456916 1XFXq0-0005ZQ-3l selectionsrestaurant.com [email protected]
2014-08-08 01:15:16 1XFXq0-0005Zi-6p SMTP connection outbound 1407456916 1XFXq0-0005Zi-6p selectionsrestaurant.com [email protected]
2014-08-08 01:15:16 cwd=/home/selectio/public_html/yorkshirepcrepair.co.uk/manager/media/rss 4 args: /usr/sbin/sendmail -t -i [email protected]
2014-08-08 01:15:16 1XFXq0-0005Zv-9N <= [email protected] U=selectio P=local S=970 T="Heh Cuckold Husband Watches Wife take a BBC" for [email protected]
2014-08-08 01:15:16 1XFXq0-0005Zv-9N SMTP connection outbound 1407456916 1XFXq0-0005Zv-9N selectionsrestaurant.com [email protected]
2014-08-08 01:15:16 cwd=/home/selectio/public_html/yorkshirepcrepair.co.uk/manager/media/rss 4 args: /usr/sbin/sendmail -t -i [email protected]
2014-08-08 01:15:16 1XFXq0-0005aB-Bs <= [email protected] U=selectio P=local S=968 T="Heh Cuckold Husband Watches Wife take a BBC" for [email protected]
2014-08-08 01:15:16 1XFXq0-0005aF-C2 <= <> R=1XFXq0-0005ZQ-3l U=mailnull P=local S=2030 T="Mail delivery failed: returning message to sender" for [email protected]
2014-08-08 01:15:16 cwd=/home/selectio/public_html/yorkshirepcrepair.co.uk/manager/media/rss 4 args: /usr/sbin/sendmail -t -i [email protected]
2014-08-08 01:15:16 1XFXq0-0005aB-Bs SMTP connection outbound 1407456916 1XFXq0-0005aB-Bs selectionsrestaurant.com [email protected]
2014-08-08 01:15:16 1XFXq0-0005aR-Do <= [email protected] U=selectio P=local S=962 T="Heh Cuckold Husband Watches Wife take a BBC" for [email protected]
2014-08-08 01:15:16 1XFXq0-0005aB-Bs == [email protected] R=enforce_mail_permissions defer (-1): "Domain selectionsrestaurant.com has exceeded the max emails per hour (300/300 (100%)) allowed. Message will be reattempted later"
2014-08-08 01:15:16 1XFXq0-0005aF-C2 ** [email protected] R=virtual_aliases: No Such User Here"
2014-08-08 01:15:16 cwd=/home/selectio/public_html/yorkshirepcrepair.co.uk/manager/media/rss 4 args: /usr/sbin/sendmail -t -i [email protected]
2014-08-08 01:15:16 1XFXq0-0005aR-Do SMTP connection outbound 1407456916 1XFXq0-0005aR-Do selectionsrestaurant.com [email protected]
2014-08-08 01:15:16 1XFXq0-0005aZ-FL <= [email protected] U=selectio P=local S=970 T="Heh Cuckold Husband Watches Wife take a BBC" for [email protected]
2014-08-08 01:15:16 1XFXq0-0005aR-Do == [email protected] R=enforce_mail_permissions defer (-1): "Domain selectionsrestaurant.com has exceeded the max emails per hour (301/300 (100%)) allowed. Message will be reattempted later"
2014-08-08 01:15:16 1XFXq0-0005ac-GX <= <> R=1XFXq0-0005aB-Bs U=mailnull P=local S=2022 T="Mail delivery deferred: returning message to sender" for [email protected]
2014-08-08 01:15:16 1XFXq0-0005aZ-FL SMTP connection outbound 1407456916 1XFXq0-0005aZ-FL selectionsrestaurant.com [email protected]
2014-08-08 01:15:16 1XFXq0-0005aB-Bs => >[email protected] <[email protected]> R=check_mail_permissions T=address_reply
2014-08-08 01:15:16 1XFXq0-0005aZ-FL == [email protected] R=enforce_mail_permissions defer (-1): "Domain selectionsrestaurant.com has exceeded the max emails per hour (302/300 (100%)) allowed. Message will be reattempted later"
2014-08-08 01:15:16 1XFXq0-0005ak-Hp <= <> R=1XFXq0-0005aR-Do U=mailnull P=local S=2015 T="Mail delivery deferred: returning message to sender" for [email protected]
2014-08-08 01:15:16 1XFXq0-0005ac-GX ** [email protected] R=virtual_aliases: No Such User Here"
2014-08-08 01:15:16 1XFXq0-0005aR-Do => >[email protected] <[email protected]> R=check_mail_permissions T=address_reply
2014-08-08 01:15:16 1XFXq0-0005as-Ii <= <> R=1XFXq0-0005aZ-FL U=mailnull P=local S=2025 T="Mail delivery deferred: returning message to sender" for [email protected]
2014-08-08 01:15:16 1XFXq0-0005aZ-FL => >[email protected] <[email protected]> R=check_mail_permissions T=address_reply
2014-08-08 01:15:16 1XFXq0-0005as-Ii ** [email protected] R=virtual_aliases: No Such User Here"
2014-08-08 01:15:16 1XFXq0-0005ak-Hp ** [email protected] R=virtual_aliases: No Such User Here"
2014-08-08 01:15:16 1XFXq0-0005b6-NA <= <> R=1XFXq0-0005Zi-6p U=mailnull P=local S=2002 T="Mail delivery failed: returning message to sender" for [email protected]
2014-08-08 01:15:16 1XFXq0-0005b6-NA ** [email protected] R=virtual_aliases: No Such User Here"
2014-08-08 01:15:16 1XFXq0-0005bB-QK <= <> R=1XFXq0-0005ZM-2C U=mailnull P=local S=2026 T="Mail delivery failed: returning message to sender" for [email protected]
2014-08-08 01:15:16 1XFXq0-0005bB-QK ** [email protected] R=virtual_aliases: No Such User Here"
2014-08-08 01:15:16 1XFXq0-0005bI-UC <= <> R=1XFXq0-0005ZV-5J U=mailnull P=local S=2034 T="Mail delivery failed: returning message to sender" for [email protected]
2014-08-08 01:15:17 1XFXq0-0005bI-UC ** [email protected] R=virtual_aliases: No Such User Here"
2014-08-08 01:15:17 1XFXq0-0005Zv-9N SMTP error from remote mail server after MAIL FROM:<[email protected]> SIZE=2014: host mta7.am0.yahoodns.net [66.196.118.33]: 421 4.7.0 [TS01] Messages from 85.92.86.252 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html
2014-08-08 01:15:18 1XFXq0-0005Zv-9N SMTP error from remote mail server after MAIL FROM:<[email protected]> SIZE=2014: host mta7.am0.yahoodns.net [98.136.217.203]: 421 4.7.0 [TS01] Messages from 85.92.86.252 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html
2014-08-08 01:15:19 1XFXq0-0005Zv-9N SMTP error from remote mail server after MAIL FROM:<[email protected]> SIZE=2014: host mta7.am0.yahoodns.net [66.196.118.36]: 421 4.7.0 [TS01] Messages from 85.92.86.252 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html
2014-08-08 01:15:20 1XFXq0-0005Zv-9N SMTP error from remote mail server after MAIL FROM:<[email protected]> SIZE=2014: host mta7.am0.yahoodns.net [66.196.118.34]: 421 4.7.0 [TS01] Messages from 85.92.86.252 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html
2014-08-08 01:15:21 1XFXq0-0005Zv-9N SMTP error from remote mail server after MAIL FROM:<[email protected]> SIZE=2014: host mta7.am0.yahoodns.net [98.138.112.33]: 421 4.7.0 [TS01] Messages from 85.92.86.252 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html
2014-08-08 01:15:21 1XFXq0-0005Zv-9N == [email protected] R=lookuphost T=remote_smtp defer (-45): SMTP error from remote mail server after MAIL FROM:<[email protected]> SIZE=2014: host mta7.am0.yahoodns.net [98.138.112.33]: 421 4.7.0 [TS01] Messages from 85.92.86.252 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html
2014-08-08 01:15:23 H=localhost (selectionsrestaurant.com) [127.0.0.1]:47661 sender verify fail for <[email protected]>: No Such User Here"
2014-08-08 01:15:23 H=localhost (selectionsrestaurant.com) [127.0.0.1]:47661 F=<[email protected]> rejected RCPT <[email protected]>: Sender verify failed
2014-08-08 01:15:23 unexpected disconnection while reading SMTP command from localhost (selectionsrestaurant.com) [127.0.0.1]:47661
2014-08-08 01:15:24 cwd=/home/selectio/public_html/yorkshirepcrepair.co.uk/manager/media/rss 4 args: /usr/sbin/sendmail -t -i [email protected]
2014-08-08 01:15:24 1XFXq8-0005eN-NM <= [email protected] U=selectio P=local S=968 T="Re: Haha Mili Jay. . . Too Cute For Porn!" for [email protected]
2014-08-08 01:15:24 1XFXq8-0005eN-NM SMTP connection outbound 1407456924 1XFXq8-0005eN-NM selectionsrestaurant.com [email protected]
2014-08-08 01:15:24 1XFXq8-0005eN-NM == [email protected] R=enforce_mail_permissions defer (-1): "Domain selectionsrestaurant.com has exceeded the max emails per hour (303/300 (101%)) allowed. Message will be reattempted later"
2014-08-08 01:15:24 cwd=/home/selectio/public_html/yorkshirepcrepair.co.uk/manager/media/rss 4 args: /usr/sbin/sendmail -t -i [email protected]
2014-08-08 01:15:24 1XFXq8-0005eQ-Pf <= [email protected] U=selectio P=local S=980 T="Re: Haha Mili Jay. . . Too Cute For Porn!" for [email protected]
2014-08-08 01:15:24 1XFXq8-0005eW-Qe <= <> R=1XFXq8-0005eN-NM U=mailnull P=local S=2022 T="Mail delivery deferred: returning message to sender" for [email protected]
2014-08-08 01:15:24 1XFXq8-0005eN-NM => >[email protected] <[email protected]> R=check_mail_permissions T=address_reply
2014-08-08 01:15:24 1XFXq8-0005eQ-Pf SMTP connection outbound 1407456924 1XFXq8-0005eQ-Pf selectionsrestaurant.com [email protected]
2014-08-08 01:15:24 1XFXq8-0005eQ-Pf == [email protected] R=enforce_mail_permissions defer (-1): "Domain selectionsrestaurant.com has exceeded the max emails per hour (304/300 (101%)) allowed. Message will be reattempted later"
2014-08-08 01:15:24 1XFXq8-0005eW-Qe ** [email protected] R=virtual_aliases: No Such User Here"
2014-08-08 01:15:24 1XFXq8-0005ef-Ti <= <> R=1XFXq8-0005eQ-Pf U=mailnull P=local S=2038 T="Mail delivery deferred: returning message to sender" for [email protected]
2014-08-08 01:15:24 1XFXq8-0005eQ-Pf => >[email protected] <[email protected]> R=check_mail_permissions T=address_reply
2014-08-08 01:15:24 1XFXq8-0005ef-Ti ** [email protected] R=virtual_aliases: No Such User Here"
2014-08-08 01:15:31 cwd=/home/selectio/public_html/yorkshirepcrepair.co.uk/manager/media/rss 4 args: /usr/sbin/sendmail -t -i [email protected]
2014-08-08 01:15:31 1XFXqF-0005hK-Qt <= [email protected] U=selectio P=local S=916 T="RE: LOL =) Voluptuous Big Natural Tits" for [email protected]
2014-08-08 01:15:31 cwd=/home/selectio/public_html/yorkshirepcrepair.co.uk/manager/media/rss 4 args: /usr/sbin/sendmail -t -i [email protected]
2014-08-08 01:15:31 1XFXqF-0005hP-SU <= [email protected] U=selectio P=local S=908 T="RE: LOL =) Voluptuous Big Natural Tits" for [email protected]
2014-08-08 01:15:31 1XFXqF-0005hK-Qt SMTP connection outbound 1407456931 1XFXqF-0005hK-Qt selectionsrestaurant.com [email protected]
2014-08-08 01:15:31 1XFXqF-0005hK-Qt == [email protected] R=enforce_mail_permissions defer (-1): "Domain selectionsrestaurant.com has exceeded the max emails per hour (305/300 (101%)) allowed. Message will be reattempted later"
2014-08-08 01:15:31 cwd=/home/selectio/public_html/yorkshirepcrepair.co.uk/manager/media/rss 4 args: /usr/sbin/sendmail -t -i [email protected]^C^

I have similiar issue with:

/manager/media/ImageEditor/img/option.php

and

assets/plugins/tinymce/jscripts/tiny_mce/plugins/directionality/images/global.php


check your ditto folder for snippet.ditto2.php

https://forums.modx.com/thread/?thread=91891&page=1
[ed. note: banzai last edited this post 12 years, 1 month ago.]

pooya1, what version of evolution are you using?

Quote from: banzai at Aug 08, 2014, 05:01 AM

I have similiar issue with:

/manager/media/ImageEditor/img/option.php

Ay caramba! What version are you using?

This was reported back in Aug 26, 2010 http://packetstormsecurity.com/files/93066/Mod-X-Cross-Site-Request-Forgery-Cross-Site-Scripting.html

This is not what you find in /manager/media today!!!
https://github.com/modxcms/evolution/tree/bugfix/manager/media

evo 1.0.6