Zen Cart Logo
Forums / General Questions / High-Tech Bridge Security Advisory - Any further info?

High-Tech Bridge Security Advisory - Any further info?

Locked

Views: 1,195

Results 1 to 6 of 6
This thread is locked. New replies are disabled.
26 Nov 2015, 6:25 AM
#1
robax avatar

robax

Zen Follower

Join Date:
Mar 2006
Posts:
187
Plugin Contributions:
0

High-Tech Bridge Security Advisory - Any further info?

Hi
I'm looking around for any further advisory around the security problem reported by High-Tech Bridge:
https://www.htbridge.com/advisory/HTB23282

In particular, am I looking at a full cart upgrade or is this is likely to be a smaller patch. And if this even affects 1.5.4 at all.

If it's big then I need to make time for it with Christmas getting close.
Regards
ROb

26 Nov 2015, 2:52 PM
#2
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: High-Tech Bridge Security Advisory - Any further info?

Initial investigation suggests that it's fixable with a small patch. But we're doing broader testing to ensure the issue is as isolated as the htbridge report claims.

It does indeed only affect v1.5.4

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

26 Nov 2015, 3:28 PM
#3
wilt avatar

wilt

Oji-san

Join Date:
Jun 2003
Location:
Newcastle UK
Posts:
1,919
Plugin Contributions:
3

Re: High-Tech Bridge Security Advisory - Any further info?

Also note. It DOES NOT affect v1.5.3 or prior versions as they do not include ajax.php.

It only affects v1.5.4

26 Nov 2015, 5:27 PM
#4
swguy avatar

swguy

Administrator

Join Date:
Feb 2006
Location:
Tampa Bay, Florida
Posts:
10,720
Plugin Contributions:
56

Re: High-Tech Bridge Security Advisory - Any further info?

Thanks as ever to the Zen Cart team for being on top of this stuff. Happy Thanksgiving!

That Software Guy. My Store: Zen Cart Support
Available for hire - See my ad in Services
Plugin Moderator, Documentation Curator, Chief Cook and Bottle-Washer.
Do you benefit from Zen Cart? Then please support the project.

26 Nov 2015, 11:26 PM
#6
robax avatar

robax

Zen Follower

Join Date:
Mar 2006
Posts:
187
Plugin Contributions:
0

Re: High-Tech Bridge Security Advisory - Any further info?

Excellent, thanks for this... I'll get patched right away!
Rob