4
You can prevent any injection attacks with Security Pro http://addons.oscommerce.com/info/5752
You can monitor sites for unauthorised changes with SiteMonitor http://addons.oscommerce.com/info/4441
You can block elicit access attempts with IP trap http://addons.oscommerce.com/info/5914
You can add htaccess protection http://addons.oscommerce.com/info/6066
You can stop Cross Site Scripting attacks with Anti XSS http://addons.oscommerce.com/info/6044
Also make sure that all files, except for the two configure.php files have permissions no higher than 644.
The permissions for the two configure.php files will vary according to the server your site is on - it could be 644, 444 or 400 which is correct.
Permissions on folders should be no higher than 755. If your hosting setup demands permissions of 777 on folders then change hosts.
You can add http://addons.oscommerce.com/info/6134 to assist with permission settings.
Do it now, avoid getting that nasty addition to your listings in google: 'This site might damage your computer'
Or find all your customers data has been posted on a hackers bulletin board somewhere, etc etc
Update Sep. 09
The following addresses issues that have arisen or were not mentioned since this post was placed:
SECURING THE ADMIN:
You must take steps to secure your admin, by re-naming & password protection. There is also a issue with hacks, read Jan's thread here.
FILEMANAGER:
It has long been known the filemanger is a security risk & should, nay MUST be removed, if used for editing your site it is likely to damage your files, so is a bad utility to keep anyway, see here. Its also been known its a possible hacking route & to make matters worse there now exists a very nasty hack that uses filemanger to gain access to your site ( dbase included!! )
Use a normal editor such as html-kit or notepad++ after downloading all your files to your PC with ftp such as filezilla.
To remove filemanger:
Delete file_manager.php from catalog/admin
open admin/includes/boxes/tools.php and delete the line:
'<a href="' . tep_href_link(FILENAME_FILE_MANAGER) . '" class="menuBoxContentLink">' . BOX_TOOLS_FILE_MANAGER . '</a><br>' .
It is also known that admin/define_language.php is vulnerable to the same hacks as filemanger, so should also be removed.
BACKUPS:
To be safe you should make backups of your dBase and site files, saves a great deal of time & effort cleaning up should anything nasty happen.
I recommend you use AutoBackup Database in Admin AND Database backup manager also Backup of all store files in zip format.
INSTALLATION:
If you are unsure about installing these contributions this thread should help you.
FORMS:
Security Pro cleans the query string, however any forms using $_POST are un-affected, if you have any forms using the post method you would be advised to do the following on pages accepting $_POST vars.
after:
require('includes/application_top.php'); add:
// clean posted vars
reset($_POST);
while (list($key, $value) = each($_POST)) {
if (!is_array($_POST[$key])) {
$_POST[$key] = preg_replace("/[^ a-zA-Z0-9@%:{}_.-]/i", "", urldecode($_POST[$key]));
} else { unset($_POST[$key]); } // no arrays expected
} This does not allow for arrays, additional code is needed if they are used.
Edited by Jan Zonjee, 23 September 2009 - 04:33 PM.
If so, maybe one can setup an .htaccess file to block write access this way?
?:n(?:et(?:\\\\b\\\\W+?\\\\blocalgroup|\\\\.exe)|(?:map|c)\\\\.exe)|t(?:racer(?:oute|t)|elnet\\\\.exe|clsh8?|ftp)|(?:w(?:guest|sh)|rcmd|ftp)\\\\.exe|echo\\\\b\\\\W*?\\\\by+)\\\\b|c(?:md(?
