Partner With Us PDA Phones & Cases Memory Promotional Golf Laptops Disney World Tickets Home Improvement Server Racks Corporate Gifts Logo Design Dental Insurance Desktop Computers Online Education KVM over IP Computer Deals

The developer of a highly-rated ecommerce shopping cart is accused of building a software backdoor into the program that could give him or hackers complete control of the server on which it's installed.

The Dansie Shopping Cart, which is currently in use at more than 200 e-commerce sites and is recommended by several Web hosting firms, contains code that enables the author, Craig Dansie of Moreno Valley, Calif., to potentially run any command on the Web server.

"He doesn't have the right to execute commands on our server without our authorization. That is technically a hack, and he put it into his code deliberately. It's unconscionable," said Joe Harris, a technical support representative at Blarg Online Services in Seattle. Harris discovered the hidden capability while helping a client install the Dansie Shopping Cart, a CGI script written in the Perl language, and publici zed his findings earlier this week on the Bugtraq security mailing list.

According to Harris, Dansie built a subroutine into the cart which enables him to use a nine-character form element or password to remotely execute commands on the server using the broad security privileges usually assigned to CGI scripts. But because the password is the same for every installation of the cart, and because the script must be installed with world-readable permission, anybody who has access to a server on which the cart is installed could retrieve the source code and the form element and use it to control other servers, according to Harris.

"It takes little imagination to dream up the potential havoc and privacy violations this level of access could result in -- from stealing private customer records to a full-blown crack of an e-commerce server," said Harris.

Dansie did not respond to repeated requests for comment. The telephone number listed in the domain record for dansie.net was disconnected sometime Thursday. And a list of several hundred customers was removed from the site Wednesday evening.

Licenses for the Dansie cart start at $150 and range up to $650 for the mall version which can handle an unlimited number of merchants on the same server.

According to Kasey Johns, Webmaster for Lonestar Badge and Sign of Martindale, Texas, the backdoor in the Dansie cart appears to be a means of protecting against unauthorized installations and of ensuring compliance with the software's licensing terms, which specifically prohibit modifying the source code. Johns said he learned of the backdoor in late March while trying to debug an installation problem.

"I tried to make some changes to it, and basically he deleted the script right off of my server. That just doesn't seem right," said Johns.

In an e-mail to Johns Wednesday, Dansie accused him of piracy and asserted that "The software has a copyright protection feature that poses NO security risk to your Web site or your Web server."

But Johns said Dansie's anti-piracy efforts are over zealous. "I want the right to look at the code, make modifications, and not be locked into whatever ghosts the author has hiding in there," said Johns.

According to Allan Knight, Webmaster for ValueWebHosting in Williamsville, New York, which has over 60 hosting clients using the cart, Dansie recently denied that the program passed information back to him. Knight, who has been using the cart for three years, said Thursday he was not aware that the script gave Dansie or others the ability to execute arbitrary commands. But Knight said he had no plans to stop using the software.

"I have never had any reason to shed any distrust on Craig whatsoever," said Knight.

While Dansie could issue a patch to customers to disable the backdoor, Harris said prudent users will uninstall the software and find a new shopping cart provider.

"His credibility is destroyed. Would you ever again trust anybody who did this? Imagine if it had been Microsoft," Harris said.