Sensei
- Join Date:
- Jan 2004
- Posts:
- 63,515
- Plugin Contributions:
- 176
Security Patch for v157/v157a
A security vulnerability has been reported for Zen Cart v1.5.7 and v1.5.7a, which is fixed by v1.5.7b (released today)
All stores using v1.5.7 or v1.5.7a should patch themselves immediately.
While your exposure is "limited" if your Admin directory name is unknown and not guessable, you still need to apply this patch ASAP.
If you are using v1.5.7a
then you can apply the changed files in this patch:
https://github.com/zencart/zencart/releases/download/v1.5.7b/patch-157a-to-157b.zip
If you are using v1.5.7 but not v1.5.7a yet,
then you can update in 2 stages:
- if you have limited time, apply just the changes in this patch1 zip:
https://github.com/zencart/zencart/releases/download/v1.5.7b/patch-157-security-patch1.zip
and then - handle the proper upgrade to v157b when you have a little more time available.
REMEMBER: In these zips the "admin" directory refers to whatever your renamed-admin directory name is. Use FTP or your hosting company's file manager to upload replacements of these files.
REMEMBER: For non-admin files, all template and module files that you have overrides for will need to be merged manually.
.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole
Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.