Site hacking

[Desertsky]

I have just been informed for the second time that my shopping cart has been hacked with an email program that is sending out spam. It was inserted into the catalog/images directory and the folder name was PHPSM. It contains four PHP files named index.php, head.php, foot.php and mysql.info.php. All files were dated april 24, 2004.

 

I cannot delete or chmod these files! I have asked my hosting service to delete these for me.

 

Anyone know how these get into the catalog? I have checked another install and they are not there. I have installed a few contributions but I hope that these were not the source!

[MarcoZorro]

They we probrably uploaded by a hacker that managed to access your admin section or that found a vulnerability in the server configuration.

[WiseWombat]

I have just been informed for the second time that my shopping cart has been hacked with an email program that is sending out spam. It was inserted into the catalog/images directory and the folder name was PHPSM. It contains four PHP files named index.php, head.php, foot.php and mysql.info.php. All files were dated april 24, 2004.

 

I cannot delete or chmod these files! I have asked my hosting service to delete these for me.

 

Anyone know how these get into the catalog? I have checked another install and they are not there. I have installed a few contributions but I hope that these were not the source!

Hi take a look at this thread.

A spammer can use your contact_us.php to send out spam.

You will also find the fix in this Thread.

 

http://www.oscommerce.com/forums/index.php?showtopic=162664&hl=

[Desertsky]

Hi take a look at this thread.

A spammer can use your contact_us.php to send out spam.

You will also find the fix in this Thread.

 

http://www.oscommerce.com/forums/index.php?showtopic=162664&hl=

 

Thanks fro the link. Although it was mostly unrelated to my issue, it did have some useful information. I found an entire mail bomb program inserted into my oscommerce site. It has been cleand out and I now need to make sure everything is still functioning.

[Desertsky]

Thanks fro the link. Although it was mostly unrelated to my issue, it did have some useful information. I found an entire mail bomb program inserted into my oscommerce site. It has been cleand out and I now need to make sure everything is still functioning.

 

Well, my hosting service was able to delete all the offending files (about 40 all together). Thanks Hostrocket!

 

They also suggested that I put an index.htm in each directory that would be vulnerable to hacking as this prevents someone from seeing what is in there. A simple redirect to your main site index works.

[WiseWombat]

Well, my hosting service was able to delete all the offending files (about 40 all together). Thanks Hostrocket!

 

They also suggested that I put an index.htm in each directory that would be vulnerable to hacking as this prevents someone from seeing what is in there. A simple redirect to your main site index works.

Putting an index.html file will work with everything eccept within the admin as it willl create an error when altering setting in the admin mystore as the html index is called rather than the default.php