Strictly speaking it's not a bug in OPN but a bug in PHP. This hotfix blocks intrusions via manipulated PHPSession variables.

Luckily an unpatched OPN 2.2.3 can withstand such attacks, but there may remain 'dead' processes on the webserver. The worst case at somehow weak webservers may be the whole webserver may be compromised.

We recommend to install this hotfix asap.

Find the hotfix here:

Zipfile
Tarfile

We guess other PHP scripts may be also concerned. So if you are using other PHP scripts and projects please watch there for security fixes and install them immediately.

Yours,
OPN-Team