Serious osCommerce Vulnerability - Hackers see all

#1

The problem affects nearly every website using osCommerce 2.2 - even with the group level login access contribution. A test for the vulnerability can be done by using the following URL example http://www.domaintotest.com/admin/orders.php/login.php change "domaintotest.com to your domain . Make sure you're logged off admin before entering the url. If you can access the site, hackers can also access all customer details including orders, peform database queries, upload php files to the images folder, send mass emails, etc without ever logging in. If using the group level login contribution test by using
http://www.domaintotest.com/admin/orders.php/login_admin.php.

As a developer, I can provide the required fix. Send me a private note if you need this fixed ASAP. Note: Priority is provided to sites storing credit card details.

Hackers are scouring the net for osCommerce websites including osCommerce showroom link that contain sites with this vulnerability which was discovered a couple of days ago.

James Berry

#2

alphaleap wrote: › The problem affects nearly every website using osCommerce 2.2 - even with the group level login access contribution. A test for the vulnerability can be done by using the following URL example http://www.domaintotest.com/admin/orders.php/login.php change "domaintotest.com to your domain . Make sure you're logged off admin before entering the url. If you can access the site, hackers can also access all customer details including orders, peform database queries, upload php files to the images folder, send mass emails, etc without ever logging in. If using the group level login contribution test by using
http://www.domaintotest.com/admin/orders.php/login_admin.php.

As a developer, I can provide the required fix. Send me a private note if you need this fixed ASAP. Note: Priority is provided to sites storing credit card details.

Hackers are scouring the net for osCommerce websites including osCommerce showroom link that contain sites with this vulnerability which was discovered a couple of days ago.

James Berry

A quick fix until this issue is patched since this is already causing problems is to place a password protection on the admin directory in your host's cPanel/File Manager.

#3

I also forgot to mention that the vulnerability affects all CRE Loaded websites as well without htaccess restrictions.

As xbaystores mentioned, a quick fix to the problem is to add htaccess login to the admin directory. You'll need to login twice but at least your site will be secure until OSC and CRE are corrected.

#4

It does not affect CRE Loaded, the very latest full release and patches of the software addresses this issue

AND if anyone is not patched all the way up to the latest release, CRE Loaded has the proper security fixes here
http://www.creloaded.com/fdm_folder_files.php?fPath=0_69

Basically its the admin/includes/application.top file that needs a code adjustment

this has been around since last july