A redirection script error on eBay's site remains open to abuse 18 months after The Register first reported it.

The flaw - actively exploited (http://www.theregister.co.uk/2005/02/28/ebay_phishing_backdoor) in phishing scams since February 2005 - creates a means to make fraudulent emails look more convincing.

Shortly after publishing a report on the problem, eBay assured us that it had plugged the hole. Despite this the site remains open to abuse through the same back door, as an email from Reg reader Adrien this week reminds us.

He notes that URLs such as this example (http://cgi1.ebay.com/aw-cgi/ebayISAPI.dll?RedirectEnter&partner=25047&loc=%68%74%74%70:%2f%2f%77%77%77.%67%6f%6f%67%6c%65.%63om%2f) are being bounced off eBay site onto other domains. In this case the surfer is redirected to Google, but sending people to less savory destinations is equally possible.

"I'm holding out for the second anniversary of the backdoor. I might bake a birthday cake and send it to them. A nice phish cake," Adrian said.

We are yet to hear back from the online auction house on whether it has any plans to address the problem. ®

Related stories

eBay scripting trick used to boost seller ratings (18 March 2008)
http://www.theregister.co.uk/2008/03/18/ebay_scripting_malfeasance/
Google and eBay thwart phishing redirection ruse (23 January 2008)
http://www.theregister.co.uk/2008/01/23/ebay_thwarts_redirection_ruse/
Cybercrooks lurk in shadows of big-name websites (12 December 2007)
http://www.theregister.co.uk/2007/12/12/phishing_redirection/
Phony BBB email dupes more than 1,400 execs (30 May 2007)
http://www.theregister.co.uk/2007/05/30/bbb_spear_phishing/
Phishers add call forwarding to their arsenal (25 April 2007)
http://www.theregister.co.uk/2007/04/25/call_forwarding_phish/
Demo neuters antiphishing measure (12 April 2007)
http://www.theregister.co.uk/2007/04/12/sitekey_bypass_demo/
Once again, 'Vladuz' impales eBay defenses (13 March 2007)
http://www.theregister.co.uk/2007/03/13/vlad_impales_ebay/
eBay plugs hole in sign-on page (2 March 2007)
http://www.theregister.co.uk/2007/03/02/ebay_sign-on_hole/
HM Revenue phish surfaces (8 January 2007)
http://www.theregister.co.uk/2007/01/08/hm_revenue_phish/
Google blacklist sheds light on phishing tactics (5 January 2007)
http://www.theregister.co.uk/2007/01/05/google_phishing_blacklist/
Phishing fraudsters get flashy (5 January 2007)
http://www.theregister.co.uk/2007/01/05/phish_flash/
Opera adds tech to foil phishers (19 December 2006)
http://www.theregister.co.uk/2006/12/19/opera_bolsters_phishing_filter/
Inside a cyber-crook's Xmas wish list (12 December 2006)
http://www.theregister.co.uk/2006/12/12/cybercrook_xmas_wish_list/
eBay shopkeepers locked out (30 November 2006)
http://www.theregister.co.uk/2006/11/30/ebay_listings_down/
US harbours one-in-four phishing sites (7 November 2006)
http://www.theregister.co.uk/2006/11/07/phishing_stats_october/
Barclays scripting SNAFU exploited by phishers (15 August 2006)
http://www.theregister.co.uk/2006/08/15/barclays_phish_scam/
Spear phishers target eBay (5 January 2006)
http://www.theregister.co.uk/2006/01/05/ebay_spear_phishing/
eBay ID fraudster jailed (2 November 2005)
http://www.theregister.co.uk/2005/11/02/ebay_phishing_scam_gang_jailed/
eBay scam gang jailed (31 October 2005)
http://www.theregister.co.uk/2005/10/31/ebay_scam_gang_jailed/
UK launches major net security awareness campaign (27 October 2005)
http://www.theregister.co.uk/2005/10/27/get_safe_online/
eBay provides backdoor for phishers (28 February 2005)
http://www.theregister.co.uk/2005/02/28/ebay_phishing_backdoor/
eBay aims to thwart phishing (6 January 2005)
http://www.theregister.co.uk/2005/01/06/ebay_anti-phishing/