How does ShipStation update order status without logging in to ADMIN?

I just started thinking while I was looking at admin logs, admin accounts, admin passwords and noticed that my ShipStation shipping software admin account never shows logging in.

There is a separate shipping vendor profile and user created in the admin section with access limited to the necessary tables.
The password has never been reset since initial setup.

The software updates order status when items are shipped.
The software downloads all orders not showing delivered status.

I just think it strange that updates can be made without any trace of activity in the admin activity logs unless this doesn't count as admin activity.

ShipStation is the shipping vendor which downloads orders and sorts them by shipping method filters and rules.... UPS, Fedex, USPS, etc

Sorry for my choice of words. It was not a question of how to make it work.

It was a question of how/why is the Shipping application able to access admin areas and modify order status without actually logging into the shipping admin account?

If I attempt to login using the URL transmitted by ShipStation which contains username/password, login is not possible because it is first intercepted by the cPanel admin folder account/password window.

Sounds like whatever script it's using has either no security checking in it (ie: it doesn't use Zen Cart's authentication) or has some other setup in it which is passing authentication.

I don't understand how the ShipStation script gets past all the zencart security checks and zencart allows it to access and edit tables (change order status from processing to delivered)

Wouldn't that be a zencart issue to be able to make admin edits without being recorded into the admin activity table?
Especially when admin user is not even logged in?

ShipStation plugin

This is the server log entry when an order status update occurs

54.208.74.167 - - [15/Dec/2014:10:05:10 -0800] "GET /shipstation_zc.php?SS-UserName=XXXXXXXXXX&SS-Password=YYYYYYYYYYYYYYYY&action=update&order_number=915318&status=delivered&comment=Package+shipped+on+12%2f15%2f2014+via+USPS+Priority+Mail.+Tracking+No+9405511699000529477591&carrier_cost=5.20 HTTP/1.1" 200 29 "-" "ShipStation"

RixStix:

How does ShipStation update order status without logging in to ADMIN?
Simple: It's not an admin script. It sits in the catalog area, and never loads the admin code.
It does do authentication using ZC functions against admin user info, but doesn't do it in a way that triggers the rest of the admin infrastructure.
That is: it does take the username and password passed to it, run that through the core ZC password validation process, but doesn't fire up the rest of the admin code.
So, if you were to change that password in your admin, you would still lock out the script from being able to run.
And likewise if they were to try to login to your admin using that password, it would let them in ... so you should still be sure you've applied appropriate restrictions to that user.
But their plugin does direct database manipulation once logged in, thus bypassing all normal checks and balances. And PCI folks would probably have a few things to say about that.

DrByte,

Thank you for the explanation. I had previously restricted access of that admin user to the bare minimum for shipping purposes.

If the admin user attempts to login, they will be met with an additional cPanel restricted folder userID/password request. Not quite 2FA, but at least a second level.

But their plugin does direct database manipulation once logged in, thus bypassing all normal checks and balances. And PCI folks would probably have a few things to say about that.

Probably not much will be done along those lines but I will submit the flaw to them.

Thanks again.

Waiting on additional comments from ShipStation.

Their first indication was "We're using zencart's API, so not our problem".

I don't see any urgent reason to have them make changes for that.

Thank you.

On second thought, it would be safer if they did their transmissions via POST instead of GET. And even better if they did it over https. Without both of those the username/pwd become accessible in ways they ought not to be.

In the meantime you've got other security protections in place to prevent abuse of a stolen password, so for you that minimizes the risk.