v1.3.5 Security Alert

wilt · 2nd October 2006, 02:31 AM

We were informed recently of an XSS exploit in Zen Cart code.

I would like to thank Armorize technologies for responding so quickly to clarify the details of the exploit, especially Wayne Huang and Benson Wu of Armorize Technologies,

You can read more about the exploit and how to patch the files that are vulnerable at

http://www.zen-cart.com/forum/showth...700#post270700

DrByte · 2nd October 2006, 06:51 AM

Zen Cart v1.3.5 XSS PATCH Released Oct 1, 2006
=================================================
To combat a reported XSS exploit vulnerability in Zen Cart, simply download the files from the patch ZIP and copy the enclosed /admin files for login.php and password_forgotten.php to your admin folder.

Remember, if you have renamed your admin folder, you will have to use *that*
folder name when copying/uploading.

File can be downloaded here:
http://sourceforge.net/project/showf...ease_id=444622

These fixes are NOT included in the main "full-fileset" zip.
Please apply these fixes AFTER unzipping the main full-fileset zip contents.

Alternatively, you may wish to apply the edits manually:
http://www.zen-cart.com/forum/showthread.php?t=47526

2nd October 2006, 02:31 AM	#1
wilt Oji-san Join Date: Jun 2003 Location: Newcastle UK Posts: 2,503	v1.3.5 Security Alert We were informed recently of an XSS exploit in Zen Cart code. I would like to thank Armorize technologies for responding so quickly to clarify the details of the exploit, especially Wayne Huang and Benson Wu of Armorize Technologies, You can read more about the exploit and how to patch the files that are vulnerable at http://www.zen-cart.com/forum/showth...700#post270700

2nd October 2006, 06:51 AM	#2
DrByte Sensei Join Date: Jan 2004 Location: Ontario, Canada Posts: 38,586	Re: v1.3.5 Security Alert Zen Cart v1.3.5 XSS PATCH Released Oct 1, 2006 ================================================= To combat a reported XSS exploit vulnerability in Zen Cart, simply download the files from the patch ZIP and copy the enclosed /admin files for login.php and password_forgotten.php to your admin folder. Remember, if you have renamed your admin folder, you will have to use that folder name when copying/uploading. File can be downloaded here: http://sourceforge.net/project/showf...ease_id=444622 These fixes are NOT included in the main "full-fileset" zip. Please apply these fixes AFTER unzipping the main full-fileset zip contents. Alternatively, you may wish to apply the edits manually: http://www.zen-cart.com/forum/showthread.php?t=47526 __________________ Zen Cart - putting the dream of business ownership within reach of anyone!

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode