Someone is spamming through my osCMax

[shazam-fu]

Hi,
I recently discovered that someone is using the scripts in my osCMax installation to send spam.

I'm not sure which script is being used but it could be any that use the following functions:
catalog_server2/includes/languages/english/contact_us.php
html/catalog/includes/languages/espanol/gv_send.php
html/catalog/includes/languages/english/gv_send.php
html/catalog/includes/languages/english/contact_us.php
html/catalog/includes/languages/german/gv_send.php

It's got to be one of these because the first subject in the spam header is "Enquiry from Southworth Company" and that text is used in the emails generated from those functions. There's a 2nd subject that replaces the first that just says "Hi."

Another part of the header is: X-Mailer: osCommerce Mailer

Is there any way to tighten up the functions to stop this? Has anyone else had this problem?

Thanks!

[michael_s]

this is most likely the culprit:
catalog_server2/includes/languages/english/contact_us.php

And it was fixed in oscmax over a year ago. You need to patch your store:
osCommerce Documentation by OSCdox :: osCommerce and osCMax installation and users manual, discussion forums (Downloads)

[shazam-fu]

Ahh, looks like I'll have to upgrade in order to fix the problem. Or will the patch work w/ v1.7?

I wouldn't mind upgrading except I'm nervous about it because there's a huge amount of data in the database. I've looked for an upgrade download but it looks like there are only full installs. Is that right? I haven't been able to find instructions for upgrading, either. But maybe I just haven't been able to find them. Are there any?

Thanks for your help!

[michael_s]

The patch will work with 1.7, but you need to manually merge in the changes, and there are some changes you need to skip (they are pretty obvious, as the modified code that needs to be skipped is completely absent from osCMax v1.7).

I have done several manual patches of v1.7 and it works well. I suggest doing the patch on an off line copy of your store to work out any kinks before attempting on your live site.

There are no instructions for upgrading, as it is not something that anyone that needs instructions should be doing at this time. osCMax 2 is still being worked on, and the upgrade path is fraught danger for the average user of osCMax

[shazam-fu]

Got it. Thanks very much!