OSCOMMERCE ORDER HACK!!!

[twigster 0]

I Have just managed to hack my website and I believe I am not the only person with this problem.

 

When buying an item from my shop I went through the normal checkout procedure.

 

I selected the postage method and then the nochex method for payment.

 

When hitting the nochex credit/debit card payment screen I typed the following in the URL address bar.

 

https://www.mydomain.com/catalog/checkout_process.php

 

This then took me to the order confirmation screen and added the items I ordered to the database without having paid for them.

 

Has this problem been spotted before and is there a fix for it as I can't go live with my shop until this has been fixed.

 

Regards

Mike

[Stickle 0]

I Have just managed to hack my website and I believe I am not the only person with this problem.

 

When buying an item from my shop I went through the normal checkout procedure.

 

I selected the postage method and then the nochex method for payment.

 

When hitting the nochex credit/debit card payment screen I typed the following in the URL address bar.

 

https://www.mydomain.com/catalog/checkout_process.php

 

This then took me to the order confirmation screen and added the items I ordered to the database without having paid for them.

 

Has this problem been spotted before and is there a fix for it as I can't go live with my shop until this has been fixed.

 

Regards

Mike

 

Have you set permissions correctly on your website? I've just tried to replicate the same error with my example store and dont appear to get any problems at all....

[twigster 0]

Have you set permissions correctly on your website? I've just tried to replicate the same error with my example store and dont appear to get any problems at all....

 

What permissions do I need to set to get this problem fixed?

 

Many Thanks

[Stickle 0]

Just the basic ones it advises in the installation file......

 

Rename the catalog/install folder or delete it.

Reset the permissions on /catalog/includes/configure.php to 644 (if you are still getting the warning message at the top set configure.php to 444 which is read only - this happens on some servers that have been updated for security reasons).

Set the permissions on /catalog/images directory to 777.

Reset the permissions on /catalog/admin/includes/configure.php to 644.

Create the dir /catalog/admin/backups and set the permissions to 777.

Set the permissions on /catalog/admin/images/graphs directory to 777.

You need to .htaccess your /catalog/admin directory so that it is password protected. You can use the password manager in your server admin area like cpanel.

[eww 1]

chmodding your folders isn't going to solve it.

i (and many others) have posted about this before and there is no known fix. verify your orders before sending stuff out is all you can do.

[yanarasod 0]

Just the basic ones it advises in the installation file......

 

Rename the catalog/install folder or delete it.

Reset the permissions on /catalog/includes/configure.php to 644 (if you are still getting the warning message at the top set configure.php to 444 which is read only - this happens on some servers that have been updated for security reasons).

Set the permissions on /catalog/images directory to 777.

Reset the permissions on /catalog/admin/includes/configure.php to 644.

Create the dir /catalog/admin/backups and set the permissions to 777.

Set the permissions on /catalog/admin/images/graphs directory to 777.

You need to .htaccess your /catalog/admin directory so that it is password protected. You can use the password manager in your server admin area like cpanel.

 

 

same problem with my catalog, thanks very very much for highlighting this, if you have any suggestions please do share. i think it's a big problem

[user99999999 1]

http://www.oscommerce.com/community/contributions,2280

 

Try this mod instead, it uses payment notification from nochex instead of browser redirect to confirm the payment similar to paypal IPN.

[yanarasod 0]

i have paypal and check and nochex still without completing payment this remains

[chooch 1]

I just decided to take a look and did the same thing, I got to the checkout confirmation page before typing in 'checkout_process' - the same thing happened.

 

You just get to the checkout confirmation page and don't hit the continue button, you simply go type in the hack and it works.

 

Yes, store owners should log in to their paypal accounts etc before releasing goods to make sure of the payment but there has to be a fix somewhere

[♥Vger 9]

I just checked this out - went as far as checkout_confirmation.php and changed the address to checkout_success.php and did go to the checkout_success.php page. However, no order was recorded in the admin panel, the shopping cart did not get updated, and no order emails got fired off.

 

I haven't been able to replicate the original problem - of getting as far as the Pay Pal payment screen, then changing the url in the address bar and coming back to checkout_success.php with the order having been processed. All that I got was the Shopping Cart page saying that the cart was empty, with no order recorded.

 

I don't know what happens with No-chex as I don't use them.

 

Vger

[yanarasod 0]

i had a quick chat on another forum and some people gave many useful tips but i am new to all this, so am posting the url as you may understand how to stop this problem.

 

http://w3schools.invisionzone.com/index.php?showtopic=4598

[dave111 0]

Just check that you actually got the money before you send stuff out :P

[yanarasod 0]

whatever it be, there must be secure solution to this

[x360modz 0]

I tried to replicate the problem and it did record the order so someone please think of how to stop this

[kgt 3]

NoChex probably posts some information to checkout_process.php. (Though OSC probably ignores this since it's not strictly necessary for completing an order). Checking for a "return value" from Nochex in checkout_process.php would verify the customer completed checkout on a third party site.

[videobus 0]

A simple solution may be to rename checkout_process.php to a non-meaningful name such as xyzabc.php and then renaming the appropriate filename definitions to match in filename.php.

This way only you know the name of the actual checkout process file. Everyone else has to guess.

 

existing:

define('FILENAME_CHECKOUT_PROCESS', 'checkout_process.php');

 

new:

define('FILENAME_CHECKOUT_PROCESS', 'xyzabc.php');

 

 

If they guess correctly, they deserve to get the item for free :)

[kgt 3]

A simple solution may be to rename checkout_process.php to a non-meaningful name such as xyzabc.php and then renaming the appropriate filename definitions to match in filename.php.

This way only you know the name of the actual checkout process file. Everyone else has to guess.

 

existing:

define('FILENAME_CHECKOUT_PROCESS', 'checkout_process.php');

 

new:

define('FILENAME_CHECKOUT_PROCESS', 'xyzabc.php');

If they guess correctly, they deserve to get the item for free :)

 

This won't stop any competent frauster. Though most wouldn't bother, they can find out the name of the checkout_process file if they place a real order, and thereafter can place orders under multiple accounts without going through the payment processing.

 

Also, if you have a payment type that doesn't require the customer to leave your site (such as COD) they can proceed as far as the confirmation screen and get the URL that posts to. From that point, they can return to the payment screen, switch to another form of payment, and skip to checkout_process.

[yanarasod 0]

the best thing is to have temporary url's that are produced by the database , each time a buyer buys a item there is a new url for the checkout _success.php and the url is auto-deleted after he moves on , or leaves the site.

 

http://w3schools.invisionzone.com/index.php?showtopic=4598

 

i got these suggestions from another forum, but dont know how to accomplish it, may be someone else can, and put an end to this issue

[kgt 3]

the best thing is to have temporary url's that are produced by the database , each time a buyer buys a item there is a new url for the checkout _success.php and the url is auto-deleted after he moves on , or leaves the site.

 

http://w3schools.invisionzone.com/index.php?showtopic=4598

 

i got these suggestions from another forum, but dont know how to accomplish it, may be someone else can, and put an end to this issue

 

Payment modules like Nochex (I assume) and Paypal require a static URL for when a customer returns to your site from their checkout.

[chooch 1]

I just checked this out - went as far as checkout_confirmation.php and changed the address to checkout_success.php and did go to the checkout_success.php page. However, no order was recorded in the admin panel, the shopping cart did not get updated, and no order emails got fired off.

 

I haven't been able to replicate the original problem - of getting as far as the Pay Pal payment screen, then changing the url in the address bar and coming back to checkout_success.php with the order having been processed. All that I got was the Shopping Cart page saying that the cart was empty, with no order recorded.

 

I don't know what happens with No-chex as I don't use them.

 

Vger

 

Regardless of the payment module selected, the hack is still there.

 

If you add an item to the cart and continue to with checkout, it should take you to the checkout_shipping page. Once shipping is selected and 'continue' selected, it should take you to the checkout_payment page. At this point you can select any method of payment you like (paypal, nochex, authorizenet - anything)

 

Once selected and 'continue' is pressed it should take you to the checkout_confirmation page - at this point all you have to is type in URL/checkout_process.php and the transaction is completed. Even the emails are sent as if a normal real order had taken place.

 

The order is also updated in admin and the method of payment you selected shows up as the method of payment.

 

The only way of distinguishing the fraudulant transaction from a bonafide one, is the fact that the payment module (ie paypal/nochex/authorizenet etc) hasn't sent you an email stating payment was sent!

 

This hack is an absolute disaster for osC-sites that have downloadable items

[40yovirgin 0]

not sure if this helps anyone, but I tried to duplicate this scenario and when I type the checkout_success.php in the browser at the checkout_confirmation.php, I get the shopping cart.php screen with an empty cart and no order generated. I use PayPal WPP , but do not use nochex.

[chooch 1]

Why type checkout_success.php?

 

You need to re-read my previous post and note where and when to type checkout_process.php regardless of the payment module used

[♥Vger 9]

I have rechecked this ,and "Yes" it is a problem - and not just with osCommerce either!

 

Vger

[luckyhuckster 0]

I have rechecked this ,and "Yes" it is a problem - and not just with osCommerce either!

 

Vger

I just successfully "swiped" one of my downloadable products this way!

 

What can be done - is there a particular Paypal mod that will prevent this?

[boxtel 1]

Why type checkout_success.php?

 

You need to re-read my previous post and note where and when to type checkout_process.php regardless of the payment module used

 

is it not possible to set a transaction code in a transaction table at the top of confirmation when confirm is selected and have checkout_process check for that entry and remove it if present and refuse execution if it is not ?