Ravens PHP Scripts: Forums
 

 

View next topic
View previous topic
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> eCommerce
Author Message
bdmdesign
Worker
Worker


Joined: May 11, 2009
Posts: 154
Location: Winsen/Luhe; Germany

PostPosted: Sat Oct 17, 2009 10:06 am Reply with quote

Hello @ll,

If you use the osc2nuke modules, you have a security hole in the osc ACP.
Check this:

Go as Guest on your site, than put this after your domain in your browser:

/modules/catalog/admin/ (http//your_domain/modules/catalog/admin/)

This will redirect you to the osc Adminlogin Page. If you dont have an oscadmin and use only the nuke admin, you will have a security hole.

Everybody can now registered a oscadmin, because there are not in the osc Database.

Try This: Login as nukeadmin and go in your shop ACP

Now go back in the NukeACP and logout. Go on your site index and put /modules/catalog/admin/ after your Domain and press enter.
After this you are again in the ShopACP as Admin. Logout in the right corner on the top >> Logged in as: (Logoff) <<, now you are redircted on the admin loginpage and its call you:

No Admin in the Database ............. !!!!!

Now we fix the hole:

go in modules/catalog/admin and open with a editor the login.php and change the completely code with this code:

Code:
<?php

/*
  $Id: $

  osCommerce, Open Source E-Commerce Solutions
  http://www.oscommerce.com

  Copyright (c) 2007 osCommerce

  Released under the GNU General Public License
*/

  require('includes/application_top.php');

  $action = (isset($HTTP_GET_VARS['action']) ? $HTTP_GET_VARS['action'] : '');

  if (tep_not_null($action)) {
    switch ($action) {
      case 'logoff':
        tep_session_unregister('selected_box');
        tep_session_unregister('admin');
        tep_redirect(tep_href_link(FILENAME_DEFAULT));

        break;
    }
  }

tep_redirect('/');
 ?>


Save it and upload it on your Space.

Try again as Guest to go on the osc Admin Loginpage, and you are redirected to your index root.

Login as nuke Admin and try to go in your osc ACP its works for you and your admins but nobody can make an Admin in a empty osc Admin Database anymore.

Have a nice Day

Best Regards

Peter

_________________
CMS-Version: pragmaMx 1.12.3.1.33.4.14 :: PHP-Version: 5.3.14 :: MySQL-Version: 5.5.23-log :: Server-Version: Apache/2.2.21 (Linux/SUSE)
Projekt: osc4pragmaMx- 2.3.2 in development 
View user's profile Send private message Visit poster's website
montego
Site Admin


Joined: Aug 29, 2004
Posts: 9457
Location: Arizona

PostPosted: Mon Oct 26, 2009 9:34 pm Reply with quote

Thank you for posting this.

_________________
Only registered users can see links on this board! Get registered or login!
Only registered users can see links on this board! Get registered or login! 
View user's profile Send private message Visit poster's website
Raven
Site Admin/Owner


Joined: Aug 27, 2002
Posts: 17086

PostPosted: Tue Oct 27, 2009 12:23 am Reply with quote

I have made this a sticky Wink
 
View user's profile Send private message
bdmdesign
PostPosted: Tue Oct 27, 2009 3:54 am Reply with quote

I have found the hole on the pragma port and my osc2nuke Version, too. Wink

Thanx for the sticky Smile


Best Regards

Peter
 
Display posts from previous:       
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> eCommerce

View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001-2007 phpBB Group
All times are GMT - 6 Hours
 
Forums ©