Any current vulnerabilities in sqlpatch.php ?

[tj1]

My host is blocking access to the sqlpatch.php

Are there any current vulnerabilities in this file? I run ZC 1.3.9h on some stores, 1.3.7 on others, I have installed all the patches mentioned here:
http://www.zen-cart.com/showthread.p...ply-for-v1-3-x

This is the error:
ModSecurity: Access denied with code 403 (phase 2). Pattern match ".php" at REQUEST_URI. [file "/var/asl/rules/99_asl_jitp.conf"] [line "2183"] [id "380628"] [rev "1"] [msg "Atomicorp.com WAF Rules - Virtual Just In Time Patch: Zen Cart SQL injection exploit"] [severity "CRITICAL"] [hostname "www.removed.com"] [uri "/removed/sqlpatch.php"]


They told me they can unblock it, but I want to make sure it's safe before they do that.

Thanks.

[DrByte]

If you are using v1.3.9h or newer, there is no vulnerability with sqlpatch.php

But your 1.3.7 site shouldn't be trusted. You NEED to upgrade that site. Whether you've "patched" it or not.