Security Alert: creLoaded <= 6.15 (HTMLAREA) Automated Perl Exploit

[mandy]

Security hole found in osCommerce branch CRELoaded

Rather simple exploit, but still an exploit nonetheless. Attempts to upload php script and
# utilise that to execute commands, and show off a fake shell.

full article and code: http://www.addict3d.org/index.php?page=viewarticle&type=security&ID=5921&title=creLoaded%20%3C=%206.15%20(HTMLAREA)%20Automated%20Perl%20Exploit

[valleygirl]

Security concerns are part of the reason  I skipped right by osCommerce when I selected a shopping cart.

[bargainbloodhound]

[quote author=valleygirl link=topic=2363.msg8424#msg8424 date=1138346831]
Security concerns are part of the reason  I skipped right by osCommerce when I selected a shopping cart.
[/quote]

The software itself isn't the problem, its the end user that is the security concern because many people don't bother to (or don't know to) install security patches as soon as they are released...and when you're using a very popular script like osC that can be a very costly mistake.