Adyx Posted October 27, 2006 Posted October 27, 2006 Hi, I have a couple of old Ms1 oscommerce stores up and running, and they have become very customized over time. However one of them had an exploit run on it this morning, and the result was a spoofed index.html file added as a quick defacement to the site. All the FTP access, server, admin access etc., seem to be fine. And the assumption is they managed to execute some code to create the index.html file. I assume this would be an sql injection scam.. and wonder if there are any obvious files inside the MS1 build that need patches related to this type of exploit. Upgrading to the recent version of oscommerce is not really an option at the moment, as that would respresent far more hassle to do then patching what is otherwise a good store system. Much appreciated if anyone has any advice.
Adyx Posted October 27, 2006 Author Posted October 27, 2006 O.K.. after some research i think i have found the bit to patch in the first instance. SQL Injection vulnerability in the create_account_process.php and the account_edit_process.php files, specifically related to the Country field, apparently can edit the "country" field to include SQL. Does anyone know of the way to patch this please ?
user99999999 Posted October 27, 2006 Posted October 27, 2006 Try fixing this one that will allow people to execute code and get files on your server. http://www.securityfocus.com/bid/5037/exploit
Adyx Posted October 28, 2006 Author Posted October 28, 2006 Try fixing this one that will allow people to execute code and get files on your server. http://www.securityfocus.com/bid/5037/exploit Hi.. thanks for that alert. But if i am not mistake this is dependant on : /inludes/include_once.php being a file that exists in your installation of the catalog ?
Adyx Posted October 28, 2006 Author Posted October 28, 2006 I have found information and a patch for this. If you need to do the same please check the following link: http://www.oscommerce.com/forums/index.php?showtopic=70525
user99999999 Posted November 2, 2006 Posted November 2, 2006 It exists in catalog/includes for MS1 unless you removed it. Hi.. thanks for that alert.But if i am not mistake this is dependant on : /inludes/include_once.php being a file that exists in your installation of the catalog ?
New 
Recommended Posts
Archived
This topic is now archived and is closed to further replies.