"extras" Directory Vulnerability Reminder

We have been informed that a list of vulnerable sites has been recently published that have the "extras" directory publicly accessible on their servers. The "extras" directory is not part of the installation but is included in the osCommerce Online Merchant download packages to assist existing users upgrade their sites through various PHP and Perl scripts that had to be manually copied to the server. These scripts are no longer relevant to the newer releases and were removed from the download package 5 years ago for the v2.2 Release Candidate 1 release.

Due to an insecure directory listing implementation, the scripts could have allowed any file on the server to be read, including configuration files and database backups, if the location of the file is known. The contents of the "extras" directory include:

[DIR] button_template
[DIR] mysql_diff
[DIR] orders
[DIR] pr21_to_pr22
[DIR] taxes
[DIR] win32
mysql.php
update.php

As some of our earlier users have left this directory on their servers, we'd like to remind them to remove the "extras" directory entirely.

We'd like to thank Chad Greene (Manager, Facebook CERT) for informing us of the publication of affected sites.

You can further discuss it on our Forum

E-commerce

E-commerce Integrations

osCommerce

Management

Ecommerce

Integrations

newsite

launch

grant

fund

replatforming

osCommerce 4.x

shopping cart

hosting

Installation

New PayPal Module (Latest API 2.0)

osCommerce 2.2

osCommerce 2.3

Shopping cart customizations

Manually

PayPal Express

APM (Alternative Payment Method)

Standard Variant

Advanced Variant

Configuration

Testing

Front End

Install osCommerce for Me

Let me install myself

Multiple sales channels

Single active sales channel

Installation on your own server

Connect

App Shop

Adding Free Module

Admin Area

Adding Paid Module

Installing Module

Opayo Pi Module

Development Mode

Email Verification Before Registration

Managing Languages

Managing phpMussel

Managing Orders

oscommerce.com account

Creating Manual Orders

Managing Customers

Managing Customer Groups

Managing Brands

Managing Categories

Managing Filters on Categories

Managing Products

Managing Stock

Assigning Products and Categories to Front Ends

Assigning and Moving Products to Categories

Managing Default Sort Order on Product Listing and Category

Managing Cross-Sell and UPSell

Managing Reviews

Managing Attributes

Managing Product Groups

Managing Properties

Managing Suppliers

Managing Warehouses

Managing Sales Statistics and Purchase Report

Managing Stocktaking Costs

Managing Deleted Orders

Managing Coupons

Managing Virtual Gift Cards

Managing Sales Price

Managing Giveaways

Managing Featured Products

Managing SEO

Managing Meta Tags

Managing XML Sitemap

Settings of E-commerce Tracking for Google Tag Manager

Setting up GA4

Managing Pages

Managing Menus

Assigning Theme to Sales Channels

Deleting Sales Channels