506 replies to this topic

[Taipo]

The easiest way is to test the admin bypass exploit for earlier versions of osCommerce:

www.yoursite.com/index.php/login.php

That should trigger osC_Sec if it is configured correctly. Depending on your settings, it will either merely stop the page from loading, or if you have ip banning activated, it will add your ip address to the main .htaccess file thus banning it.

[jamo32]

Taipo, on 25 April 2013 - 04:15 AM, said:

The easiest way is to test the admin bypass exploit for earlier versions of osCommerce:

www.yoursite.com/index.php/login.php

That should trigger osC_Sec if it is configured correctly. Depending on your settings, it will either merely stop the page from loading, or if you have ip banning activated, it will add your ip address to the main .htaccess file thus banning it.

Hi

I got forbidden page Additionally, a 404 , is this osc_sec or  or htacess? sorry to sound daft.

Many thanks

Edited by jamo32, 25 April 2013 - 08:55 AM.

[callenords]

callenords, on 14 August 2012 - 08:12 AM, said:

The solution: Find and remove (line 428 in osc_sec.php): "%000",

If you are using Google Adwords ads, the code above triggers the security system for some of your paid visitors (Google Adwords ads a "?gclid=XXXXXXXXX" parameter that in some cases triggers the security system).

I hope removing the code above is ok?

I've noticed that apart from removing "%000" you also need to remove these 3 from osc_sec.php:

"%bf%27"
"%a3%27"
"%8c%5c"

The gclid parameter sent by Google Adwords have triggered my security system several times because of them on "normal" visitors. I hope it is not a security risk to remove them

[Taipo]

"I hope it is not a security risk to remove them"
No problem with removing those items

I have popped up an update with those items removed.
Goto: http://addons.oscommerce.com/info/8283

[mr_absinthe]

But it still contains "%000"...

[Taipo]

Try now
http://addons.oscommerce.com/info/8283

[mr_absinthe]