maliscious upload trough contact form

Im using 1.39h currently and my host has indicated that there may be maliscious files being uploaded to server through my zencart contact form.

Is there any way to disable contact form in zencart to test and make sure?

I get the following emails every hour on the hour.
Time: Wed May 16 09:15:33 2012 -0400
File: /tmp/bot.txt
Reason: Script, starts with #!
Owner: apache:apache (48:48)
Action: No action taken

If i can disable contact form and the notice stops then I know the compromise is coming from my zencart and not another site on server.

Thanks for any help or imput on this.

You could do that one of two ways ...

You could rename the directory:
/includes/modules/pages/contact_us

to something like:
/includes/modules/pages/contact_us_HIDE

so it cannot run ...

Or if you want customers to still use it, force a login by adding the code to:
/includes/modules/pages/contact_us/header_php.php

in RED:

if (!$_SESSION['customer_id']) {
  $_SESSION['navigation']->set_snapshot();
  zen_redirect(zen_href_link(FILENAME_LOGIN, '', 'SSL'));
}
 
require(DIR_WS_MODULES . zen_get_module_directory('require_languages.php'));

Now customers have to login to use it ...

Thank you for your reply and help. I dont have a includes/pages/ though. This is a 1.3.9h version.

Sorry I have missed /modules in the path name and corrected it for you ...

Thank you very much for your help.

You are most welcome ... :smile:

Ok, just heard back from hosting admins and it appears there is a suspicious piece of code that was added to define_conditions.php
The code was:

Not sure how it got there, if it is in fact a maliscious code or not, so thought I would post here as a heads up to everyone. If any mods can confirm or deny if this is needed for zencart or added for maliscious purposes please advise. Thanks.

That is not part of Zen Cart core code and is not good code to have ...

On your define pages, once you have set them, it is a good idea to change the files to 644 until you actually need to change them again ...

Was this a clean Zen Cart v1.3.9h that you installed or an Upgrade?