Https: Www.360totalsecurity.com

Earlier this week, 360 Security Center discovered that a famous download website, 52pk.com, was injected with a flash exploit, CVE-2018-4878. Few days later, we also found famous IT website, 51CTO.com, and medical website, cmechina.net, were compromised as well. After analyzing the injected code, these three injection attacks came from the same criminal group and were formed with the notorious exploit kit, GreenFlash Sundown.

https: www.360totalsecurity.com

Take 51CTO.com and cmechina.net for example, their OpenX system contains lots of known vulnerabilities. OpenX system has been revealed multiple times carrying many high risk vulnerabilities, including XSS, CSRF. Among these vulnerabilities, CVE-2013-3514 and CVE-2013-3515 is related to XSS and affects version 2.8.10 and below. This allows attackers to inject arbitrary code. CVE-2013-4211 affects 2.8.10 and above and allows attackers to installs backdoor on PHP pages. Figure 4 shows the accumulated vulnerabilities of OpenX system from exploit-db. 041b061a72