Hackers loading .PHP files into my Image folder. Code?

[ALL4739]

Google loaded a link to my images file. I now have "suckers" who are loading a modified oscommerce website using .PHP files to use my host server for free. I have been deleting them every weekend, but they keep coming back. Is there a code or method to stop anything but image related files being loaded or changing the name of my image file. Google is worthless concerning taking down exposed links.

[Jack_mcs]

I'm not clear as to what the problem is but it sounds like your shop is not protected. Can you provide links to illustrate the problem?

[knifeman]

As Jack said, it sounds like your store is unprotected. Jan posted some code here to stop php files from running in the images directory:

http://www.oscommerce.com/forums/topic/367622-thumbsdbphp/

# $Id$
#
# This is used to restrict access to this folder to anything other
# than images
# Prevents any script files from being accessed from the images folder
<FilesMatch "\.(php([0-9]|s)?|s?p?html|cgi|pl|exe)$">
  Order Deny,Allow
  Deny from all
</FilesMatch>

 

BUT first, you need to lock down your store and remove any malicious code. If hackers can upload files to your images directory, what else are they/can they do???

 

Once cleaned and ready for business, all security patches/precautions should be in place. These will depend upon the version of osc you have installed. Then you can unlock the store and reopen for business.

 

Tim