Find spam-vulnerable osCommerce scripts

[gvard]

Greetings from Greece,

Many clients that use osCommerce haven't performed the necessary updates, and spammers may use contact_us.php to send spam e-mails via injection.

Can anyone offer any solution to search all hosting accounts on the server for vulnerable osCommerce contact_us.php pages via shell?


Thanks!

 

[jackie46]

http://www.gotroot.com/tiki-index.php?page=mod_security+rules

 

[gvard]

Ok, and which ones from those filters are for osCommerce contact_us.php problem? Is the "osCommerce XSS" section?

 

[AndyReed]

Ok, and which ones from those filters are for osCommerce contact_us.php problem? Is the "osCommerce XSS" section?

Tracking down spammers and what scripts they use to go through your server is not an easy job. Are you sure the problem is osCommerce only and doesn't include other scripts?

 

[gvard]

Hello,

Of course one can never be sure that everything is OK and spammer-free, but right now I want to be able to apply this fix:

http://www.oscommerce.com/community/bugs,3279/status,open/page,2

I want to find out somehow which contact_us.php files are vulnerable and then notify the clients for the changes they have to make.