Loaded Commerce Community

Found solution here:

"Very recently it came to our attention that there was a way of bypassing the osCommerce database driven login. We're not giving details here, but we tested the hack ourselves and proved that it works...."

http://forums.oscommerceproject.org/ind ... topic=1472

TIA,
Kerry

The link is broken. Any other helpful links?

Fairly old news this ... fix is here:
http://www.codemehappy.com/2010/10/admi ... sed-carts/

Simon

Simon,

Nice article. Yes, this has been around quite awhile, but it remains very much current news for the many users who missed the various announcements and are still being hacked to pieces because of it.

We still deal with many of these cases. One thing I would point out is that the fix is NOT always that straightforward. Many modified sites have additional instances of PHP_SELF direct global usage. Each of these must also be fixed to completely close loopholes.

Also worth noting that it is a LOT cheaper to fix this before you are hacked...

David

Hi David,

Yes, I see quite a few 6.2 carts in this state. And there are several other places too (esp payment modules) where this patch could apply, but the Admin login is the most 'troublesome.'

In another but security related area and referring to the 'XSS hack' subject line, I'm wondering also why cre doesn't update dbase queries to prepared statements, which I think would address some of the cross script injection issues. One of the good things to me about zencart is the design of their queries.

Do you know?

Simon

CRE Loaded is somewhat of a branch - Zen Cart is a complete fork. For CRE to use prepared statements would require a fork.

David