0
This has been the basis for most of the attacks that has plagued osCommerce since the login feature was added. In older versions of osCommerce where no login was required, users have to use the basic http authentication method to properly protect their admin directory from unauthorized access.
Although this is covered already if you have added recent versions of the addon osC_Sec to your site, below are the instructions for those who do not intend to use the osC_Sec addon.
Patching the exploit is in two parts. Firstly an extra login check needs to be added.
Open admin/includes/application_top.php
Find:
$redirect = true; }
After add:
if (!isset($login_request) || isset($HTTP_GET_VARS['login_request']) || isset($HTTP_POST_VARS['login_request']) || isset($HTTP_COOKIE_VARS['login_request']) || isset($HTTP_SESSION_VARS['login_request']) || isset($HTTP_POST_FILES['login_request']) || isset($HTTP_SERVER_VARS['login_request'])) {
$redirect = true;
}
Open admin/login.php
Find:
Released under the GNU General Public License */
After add:
$login_request = true;
The second part is to replace the $PHP_SELF code in both application_top.php files.
Open admin/includes/application_top.php
Find:
// set php_self in the local scope $PHP_SELF = (isset($HTTP_SERVER_VARS['PHP_SELF']) ? $HTTP_SERVER_VARS['PHP_SELF'] : $HTTP_SERVER_VARS['SCRIPT_NAME']);
Replace with:
// set php_self in the local scope
$PHP_SELF = (((strlen(ini_get('cgi.fix_pathinfo')) > 0) && ((bool)ini_get('cgi.fix_pathinfo') == false)) || !isset($HTTP_SERVER_VARS['SCRIPT_NAME'])) ? basename($HTTP_SERVER_VARS['PHP_SELF']) : basename($HTTP_SERVER_VARS['SCRIPT_NAME']);
Open includes/application_top.php
Find:
// set php_self in the local scope if (!isset($PHP_SELF)) $PHP_SELF = $HTTP_SERVER_VARS['PHP_SELF'];
Replace with:
// set php_self in the local scope
$PHP_SELF = (((strlen(ini_get('cgi.fix_pathinfo')) > 0) && ((bool)ini_get('cgi.fix_pathinfo') == false)) || !isset($HTTP_SERVER_VARS['SCRIPT_NAME'])) ? basename($HTTP_SERVER_VARS['PHP_SELF']) : basename($HTTP_SERVER_VARS['SCRIPT_NAME']);
Ends
