IMPORTANT: Security Patch

CubeCart Forums: IMPORTANT: Security Patch - CubeCart Forums

Help

Page 1 of 1

You cannot start a new topic
You cannot reply to this topic

IMPORTANT: Security Patch Affects all versions prior to 3.0.12 released later today

#1 Al

Group: Staff
Posts: 4,120
Joined: 09-April 03

Post icon Posted 17 August 2006 - 08:52 AM

Security Patch
A vulnerability report has been issued to us concerning XSS (Cross Site Scripting) and MySQL Injection vulnerabilities in all current versions of CubeCart.

Please see: http://bugs.cubecart...=details&id=523

We urge all to patch their stores at the first possible opportunity. This vulnerability is due to the fact certain variables are not properly sanitized.

This patch resolves the issues using the treatGet function already in place in the code.

To upgrade please download the file CubeCart_Patch_17Aug06.zip extract it and upload the contents over the files that already reside on your site. Manual upgrade instructions can be found in the file CubeCart_Patch_17Aug06_changelog.html which is also attached.

Even if you don't use the Authorize.net or Protx module you must update the files!

CubeCart 3.0.12
A new release will be made today which includes this patch and Spam Bot flood control protection as we have had reports of the tell a friend tool being abused. There will also be path upgrades in the PayPal SDK and other minor issues fixed.