More than 100 e-commerce sites vulnerable to shopping cart flaw

A list of more than a hundred online small businesses running vulnerable functions of shopping cart software osCommerce has been published online.

The vulnerable sites could have database passwords stolen and granted access to attackers.

Each contained a directory dubbed extras that had been identified as insecure in 2006 and removed from osCommerce versions.

It was introduced in the osCommerce Online Merchant download which assisted users to upgrade PHP and Perl scripts on their sites.

An insecure directory listing implementation meant those scripts allowed any file on the server to be read, including configuration files and database backups, if the location of the file was known.

The company said the scripts were not relevant to current releases and that users should remove them.

Many websites in the list were duplicates and three of the sites were Australian companies.

Context Information Security consultant Michael Jordon said the local file inclusion vulnerability allowed "for any file on the system to be read which could easily lead to a full compromise of the server" if for example attackers had found a data backup file.

“If the database is available from the internet, then it's game over,” he said.

He said the discovery of the vulnerability was not "particularly clever" and was likely found through Google search queries.

“The listed websites need to patch urgently and change all database connector credentials and then check that no credit card, personal data or passwords were in clear text in the database.”

This article originally appeared at scmagazineuk.com