"Through a documented exploit, fraudsters are able to identify and target merchants running vulnerable versions of this osCommerce software and compromise that software remotely. (The exploit can be found at www.exploit-db.com/exploits/15587/; a sample of the attack script and exploit code can be found by clicking here.) Once the software has been compromised, criminals can perpetrate fraud.

Specifically, fraudsters are targeting a vulnerability in the /admin/categories.php file that allows attackers to gain administrator-level access to the web server by uploading a PHP command shell remotely through modification of the host and path variable statements.

Once access has been obtained through the shell file, fraudsters have uncontrolled access to the web server and the data therein. They can then create and host fraudulent phishing pages to capture consumer data (such as primary account numbers, cardholders' names, cardholders' addresses and other personally identifiable information) or download additional hacking tools (such as sniffing software) to capture credentials."