Security Fix for Admin Login Module Support 2.2 RC1

[naylwin]

Hi Guys,

 

Without logging into your admin panel, hacker can access to your site via:

http://[www.yoursite.com]/admin/categories.php/login.php?cPath=&action=new_product_preview

 

https://[www.yoursite.com]/admin/file_manager.php/login.php

 

To patch your site, open /admin/includes/application_top.php

 

find:

$current_page = basename($PHP_SELF); // around Line 136

 

replace:

$current_page = basename($_SERVER['SCRIPT_NAME']);

 

 

Add-Ons Link

 

I hope this helps someone.

Edited May 14, 2011 by naylwin

[PiLLaO]

Hi!,

 

Look this other fix http://www.oscommerce.com/forums/topic/348589-serious-hole-found-in-oscommerce/page__st__80__p__1467014#entry1467014

 

Regards!!

[naylwin]

Thanks PiLLaO!

 

New Version is added http://addons.oscommerce.com/info/8003

 

Note that this fix is not necessary for osCommerce 2.3.1

 

:)

[Guest]

That's a redundant contribution because it is for an out-dated version of osCommerce AND it is already covered in the security forum. If anyone is still using RC1, they should have updated a long time ago.

 

 

 

 

 

Chris

[naylwin]

Thanks for letting me know, Chris. I agree with you on upgrading to the latest version. I have a handful of clients who do not have experience in PHP/MySQL and also not willing to spend money for upgrading the software. Including myself, many of my clients who run older version of osCommerce; we have installed many contributions on the site, and we do not find any proper upgrade process or instruction to carry over all our contributions to new version. In default instruction, it is suggesting us to over-write all the new files to on our osCommerce site; which is definitely not possible. We have spent many years and expenses to have these contributions to our site, and we cannot afford to lose them just to get our site upgraded to new version.

 

Therefore, we will always need the security fixes for older version whenever new version is released.

 

-Nay