Regarding Following Email and Several DNN hacked, I find php.js in my "ROOT/Resource/Shared/php.js" and I Could Not Delete this fild. How can I delete this file?

In April 2015, we issued a security warningrelated to the DNN install wizard (“InstallWizard.aspx”). The security warning included instructions on how to protect your site. While we issued a patch in May 2015, we recently learned about a new mechanism to exploit this same vulnerability.

This vulnerability is quite severe. It enables an external user to:

Create a new Host account.
Update Host records and tables.
Clear SMTP settings.
Upgrade or alter installed modules.

The following steps are required to safeguard your site against this vulnerability:

Remove the Install.aspx, Install.aspx.cs,InstallWizard.aspx, InstallWizard.aspx.cs, UpgradeWizard.aspx and UpgradeWizard.aspx.cs files from the Website Root/Install folder immediately.
Go to Host > Host Settings page > Other Settings section > under Allowable File Extensions > and ensure that the .aspx extension is NOT allowed to be uploadable.
Go to Host > SuperUser Accounts page and review the list of users in the Super User section to ensure that only known and authorized users are listed. Remove any unauthorized users.
Search the Root folder and subfolders of your site for any files with .aspx or .php extensions. Some .aspx files might be required for your site. Carefully inspect any files before deleting.

We have also just released Evoq 8.4.2 and DNN Platform 8.0.3 to further mitigate this issue. Evoq customers can download the latest packages from the Customer Support Network. DNN Platform users can download the latest packages fromhttp://dotnetnuke.codeplex.com. Please visit our Security Center for additional information about security issues that have been addressed with each release.

As a reminder, you can always emailsecurity@dnnsoftware.com if you believe you have discovered an exploit or vulnerability.

Sincerely,
Will Morgenweck
VP, Product Management

Alex,
due to security issues, you should uninstall the FCK editor (or manually remove reference from your web.config and delete folder C:\inetpub\wwwroot\MyWebSite\Providers\HtmlEditorProviders\Fck with all its content.

---

Cheers from Germany,
Sebastian Leupold

   

Speed up your DNN Websites with TurboDNN

in Host > Extensions, check Sections Modules and Providers for "FCK Editor" (not CKEditor) with "uninstall" link.
if not available, edit your web.config and search for "FCK". it should be listed in section htmlEditor, but NOT as defaultProvider (if it is default provider, replace by "DotNetNuke.RadEditorProvider", which should be listed in one of the following lines). Delete Line starting with add name = "fck"
now delete folder /providers/htmleditorproviders/fck with all files and subfolders.

---

Cheers from Germany,
Sebastian Leupold

   

Speed up your DNN Websites with TurboDNN