iResponse+ 4.6 Pro Release Notes:
•⁠ ⁠Added support for CentOS 9, AlmaLinux 9, and Rocky Linux 9 due to CentOS 7 reaching its end of life.
•⁠ ⁠Enhanced the "Cloud APIs" and "Install MTA Servers" pages to allow users to select from three different PMTA versions (v4.5 and v5) during server installation.
•⁠ ⁠Added Firewall protection to block access to iResponse and PMTA Monitoring.
•⁠ ⁠Add Squid proxy to any server.
•⁠ ⁠Implemented support for Vultr API version 2.
•⁠ ⁠Fixed server creation with Hetzner API.
•⁠ ⁠Fixed server remote connection on Scaleway servers.
•⁠ ⁠Fixed a rendering issue with the PMTA 4.5 and PMTA 5 monitoring iframe.
•⁠ ⁠Resolved an issue with the Everflow suppression link.
•⁠ ⁠Fixed a problem with the Cake API offers links.
•⁠ ⁠Resolved an issue with Bitly links.

iResponse+ V4.6 -Add Firewall protection to block access to iResponse and PMTA Monitoring.

The fix rendering issue with the PMTA 4.5 and PMTA 5 monitoring iframe

Version 4.7

❗️Urgent:iResponse+ V4.7 fiha FIX dyal backdoor o Nas li mazal ma5dat iResponse+ V4.7 diro back up ndata dyalkom.

3an7ot commands dbackups odiro share n had msg f gaa3 les groups kamlin

pg_dump -U username -N suppressions -f /root/ir_clients.sql ir_clients

pg_dump -U username -f /root/ir_system.sql ir_system

username bdlo b user dyalak.

Version 4.8

fix sql injection
app/webservices/Tracking.php

attacker uses the old code to get access to irepsonse

here is the fixed file, replace the old on app/webservices/Tracking.php
then run chown -R apache:apache /usr/iresponse/app/webservices/Tracking.php

this only works if master does not use firewall, there is another bug that gives access from MTA servers, you can get the latest update in iresponse+ 4.8

to remove shell from your master run
find /usr/iresponse/public -type f -name '*.php' ! -name 'index.php' -exec rm -f {} \;

Please share the fix