Security Issues..still?

[adiwillow]

Hi all,

Were still having problems with spamming via our OSCmax sites. I've done the security issues as far as i'm aware, or perhaps they were done already in my version ? There is loads of '// EOF: MS2 update 501112-Added ' comments in general.php etc.. so i'm assuming they're done.

Anyway, were STILL getting blocks for email flooding on our OSC accounts..

Are there any security issues which have been overlooked? Is it possible that the Admin levels contrib is being exploited and emails are being sent from the admin panel?

i really need to sort this.. has anyone any pointers , or can anyone confirm if the 501112 security updates really are secure?

Thanks

[jpf]

Are you asking about "Contact us"? part. Or your just getting alot of SPAM in your inbox?

Thing to do:
- Change your email address. ONLY use a certain email box for your automated MAX mailing to your self.

- Use a differnet box for emails going out to users. IE - Automated email - do not reply - as you don't check this mailbox - type of mailbox.

- Secure your ADMIN and SQL password (change both passwords)

- Move the ADMIN to another DIR.... ie: /catalog/secret_dir/that_is/hard_to_guess/admin..... (remember to book mark it!)

- Remove the contact us screen. Or add a human confirmation code.

[jpf]

Are you asking about "Contact us"? part. Or your just getting alot of SPAM in your inbox?

Thing to do:
- Change your email address. ONLY use a certain email box for your automated MAX mailing to your self.

- Use a differnet box for emails going out to users. IE - Automated email - do not reply - as you don't check this mailbox - type of mailbox.

- Secure your ADMIN and SQL password (change both passwords)

- Move the ADMIN to another DIR.... ie: /catalog/secret_dir/that_is/hard_to_guess/admin..... (remember to book mark it!)

- Remove the contact us screen. Or add a human confirmation code.

[kenlyle]

I just ran a ScanAlert scan on my OSCMax domain, and they said:

"
WebApp Cross Site Scripting

The remote web application appears to be vulnerable to cross site scripting (XSS).
"
This was only two days ago...
...but they also misidentified the application as CubeCart - I am working with them...If I forget to post back within a week, somebody nudge me by PM.

Thanks,
K