More than 100 e-commerce sites vulnerable to shopping cart flaw

Powered by SC Magazine
 

Lack of patching leaves companies exposed.

A list of more than a hundred online small businesses running vulnerable functions of shopping cart software osCommerce has been published online.

The vulnerable sites could have database passwords stolen and granted access to attackers.

Each contained a directory dubbed extras that had been identified as insecure in 2006 and removed from osCommerce versions.

It was introduced in the osCommerce Online Merchant download which assisted users to upgrade PHP and Perl scripts on their sites.

An insecure directory listing implementation meant those scripts allowed any file on the server to be read, including configuration files and database backups, if the location of the file was known.

The company said the scripts were not relevant to current releases and that users should remove them.

Many websites in the list were duplicates and three of the sites were Australian companies.

Context Information Security consultant Michael Jordon said the local file inclusion vulnerability allowed "for any file on the system to be read which could easily lead to a full compromise of the server" if for example attackers had found a data backup file.

“If the database is available from the internet, then it's game over,” he said.

He said the discovery of the vulnerability was not "particularly clever" and was likely found through Google search queries.

“The listed websites need to patch urgently and change all database connector credentials and then check that no credit card, personal data or passwords were in clear text in the database.”

This article originally appeared at scmagazineuk.com

 

Copyright © SC Magazine, UK edition


More than 100 e-commerce sites vulnerable to shopping cart flaw
 
 
 
Top Stories
Slow progress in Turnbullistan
[Blog post] How has the NBN moved ahead since regime change?
 
Hacks and frauds can't dampen Bitcoin buzz
[Blog post] Enthusiasts meet in Melbourne.
 
Qantas checks in with cloud computing
Impressed with results of public cloud bake-off.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  23%
 
Application integration concerns
  3%
 
Security and compliance concerns
  31%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  24%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  4%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 554

Vote