More than 100 e-commerce sites vulnerable to shopping cart flaw

Powered by SC Magazine
 

Lack of patching leaves companies exposed.

A list of more than a hundred online small businesses running vulnerable functions of shopping cart software osCommerce has been published online.

The vulnerable sites could have database passwords stolen and granted access to attackers.

Each contained a directory dubbed extras that had been identified as insecure in 2006 and removed from osCommerce versions.

It was introduced in the osCommerce Online Merchant download which assisted users to upgrade PHP and Perl scripts on their sites.

An insecure directory listing implementation meant those scripts allowed any file on the server to be read, including configuration files and database backups, if the location of the file was known.

The company said the scripts were not relevant to current releases and that users should remove them.

Many websites in the list were duplicates and three of the sites were Australian companies.

Context Information Security consultant Michael Jordon said the local file inclusion vulnerability allowed "for any file on the system to be read which could easily lead to a full compromise of the server" if for example attackers had found a data backup file.

“If the database is available from the internet, then it's game over,” he said.

He said the discovery of the vulnerability was not "particularly clever" and was likely found through Google search queries.

“The listed websites need to patch urgently and change all database connector credentials and then check that no credit card, personal data or passwords were in clear text in the database.”

This article originally appeared at scmagazineuk.com

 

Copyright © SC Magazine, UK edition


More than 100 e-commerce sites vulnerable to shopping cart flaw
 
 
 
Top Stories
Business-focused Windows 10 brings back the Start menu
Microsoft skips 9 for the "greatest enterprise platform ever".
 
Feeling Shellshocked?
Stay up to date with patching for the Bash bug.
 
Amazon forced to reboot EC2 to patch Xen bug
Rolling restarts over next week.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Which is the most prevalent cyber attack method your organisation faces?




   |   View results
Phishing and social engineering
  66%
 
Advanced persistent threats
  5%
 
Unpatched or unsupported software vulnerabilities
  11%
 
Denial of service attacks
  6%
 
Insider threats
  12%
TOTAL VOTES: 1375

Vote