I had my osCommerce hacked a few moments ago and the morons are using it to send emails. I have identified that they placed scripts inside osCommerce images directory.

Is there a way to forbid certain directories like those containing images from running scripts using .htaccess or something?

Using simply

<Files *.*>
order allow,deny
deny from all

on .htaccess is not good because images will not appear on the site.

What can I do beyond applying all osCommerce patches to make it stronger?


I believe you can drop this into an .htaccess where ever you don't want to allow scripts to execute:

<Files *.*>
Options -ExecCGI

If you know all the "bad" files are named a certain way you could also disable their being associated to a given handler with this:

<Files *.*>
RemoveHandler cgi-script .php .pl .py .jsp .asp .htm .shtml .sh .cgi

You can also completely shutdown certain named files with this one from a top level directory:

<Directory full-path-to/dir>
     <FilesMatch "\.(php?|pl|perl)$">  
         Order Deny,Allow
         Deny from All

Or you can lock it down based on the actual URL used to get to it:

<LocationMatch "/URL/TO/FILES/.*\.(php?|pl|perl)$">
     Order Deny,Allow
     Deny from All

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.