[TiM's osC Solutions] osCommerce Threat Scanner

[michael_s]

Updated to identify a couple of more known threats.

Help developing this contribution and fight the evil code out there.

More...

[clea023]

terrific contribution! It's been a tremendous help in finding vulnerabilities.

Any chance future versions will be able to check the real CHMOD status? Scanning through 28 screens (literally) of massively long file locations all followed by [If possible, chmod 644] gets rather rough on the eyes -- difficult to see actual problems.

I would like to add the left column link so that I don't have to type the file name every time I use the scanner, but there's no way I can let a client see 28 screens of [If possible, chmod 644] when they login to take care of orders, adjust inventory, view reports, and generally make sure all is happy. All of the files listed are 644 or lower, yet there they are on the list, straining the heck out of my eyes.

The only thorn not yet fixed is the pesky XSS. I've executed what I THOUGHT were three different fixes for this (including the specific one that threat_scanner.php suggests) and the scanner still shows it as being vulnerable. Is there one SPECIFIC fix it expects to find?