Beanstream PCI Compliance Failure: Logout Page. Please HELP!

Hi,

We are currently in the PCI Compliance process with Beanstream, and I am having a bit of a problem. One of the Failures we got is as follow:

The logout page of this site is prone to a cross-site request forgery vulnerability. Attackers could exploit this condition to prevent legitimate users from accessing the site.

We are using Zen-Cart 1.3.7 (for reasons I won't list here, we cannot go through an upgrade right now...)

They are asking that we rewrite the vulnerable page to make it resistent to cross-site request forgery attacks. I have no clue how to do this!

Is there a solution for this, aside from upgrading?

Thank you in advance for any help!

Not the answer you wanted, but I would guess that if that vulnerability existed in version 1.3 7, it has been fixed in later versions. There isn't really any alternative to upgrading.

Would it be possible to update just the affected part ?

Probably not. The Zencart developers would have to provide all the affected files, and I doubt if they would be inclined to do so.

If you let us know why you don't want to upgrade, we might be able to suggest something.

You should be avoiding "sticking-plaster" solutions rather than actively looking for them.

There are MANY reasons why maintaining current software is important.

You should upgrade.

Upgrade now or delay PCI Compliance until upgrading has been done. To do otherwise is futile.

The main reason why we do not want to go through upgrade right now are as follow:

The site was created by someone who has left us over 2 years ago. He used a lot of addon modules and customized a few things along the way. Most important, we have no documentation on all the modifications he made.
We were planning on the upgrade this summer, going through the process, with what I mentioned before, needs to be carefully planned and as effective as possible. Unfortunately, it just doesn't fit into our planning right now.
I really want to take the time to make sure I can address all the possible problems we might encounter along the way and it is just not possible for me to take that time right now.
So if anybody can help me out, it would be greatly appreciated.

Thank you for all your advices, it is very much welcomed!

But ... what alarms me even more is that in another thread you've said that you're making a copy of this OLD 1.3.7 site to start another NEW store!!!!!
Surely THIS would be a VERY SMART time to actually start from an up-to-date code-base, not one that was released in 2006 !!!!

As others have said in not so many words, the whole purpose of the v1.5.0 release was PCI Compliance. It would make a lot of sense to start there with your new store. And, since the many changes in 1.5.0 are about PCI Compliance, your "fix" for this existing site you're reporting problems with might well be wrapped up in the new code, or at least in the module changes made necessary by the new code.

Repairing a hacked store is about 8 times more expensive than the cost of upgrading... not counting the lost sales in downtime.

...Or the lost reputation/lawsuits/fines if you have customers whose credit cards have been stolen...