Sensei
- Join Date:
- Jan 2004
- Posts:
- 63,511
- Plugin Contributions:
- 176
Admin Security -- Patch issued
In Zen Cart v1.2 through v1.3.7 an admin vulnerability exists which could let a rogue user login to your admin area unmonitored.
As always, it is WISE TO RENAME YOUR ADMIN FOLDER.
If you have already renamed and not told anyone the new name of your admin folder, you are much less likely to be affected.
The patch should be applied based on the version you're using. You can find the patches at SourceForge:
v1.3.7
v1.3.6
v1.3.5
v1.3.0.2
v1.3.0.1
v1.3.0
v1.2.7
v1.2.6
v1.2.5 and earlier -- please upgrade to benefit from all other security fixes in newer versions.
REMEMBER -- The BEST SECURITY for your Admin area is to RENAME it from /admin/ to something else.
See your /docs folder for instructions, or see the FAQ here:
Security Recommendations, including Renaming the Admin folder
The Zen Cart team is thankful to Tomaz Bratusa at Team Intell for reporting this vulnerability.
Vulnerability issues should be reported to team AT zen-cart DOT com.
.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole
Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.