CubeCart 4.3.7 Released + Another Security Patch

CubeCart Forums: CubeCart 4.3.7 Released + Another Security Patch - CubeCart Forums

Help

Page 1 of 1

You cannot start a new topic
You cannot reply to this topic

CubeCart 4.3.7 Released + Another Security Patch Update is important....

#1 Al

Group: Staff
Posts: 4,120
Joined: 09-April 03

Post icon Posted 18 November 2009 - 11:36 AM

CubeCart 4.3.7 has been released which patches a possible SQL injection vulnerability found by Sangte Amtham.

It is very straightforward to patch this vulnerability...

Method 1:
Upload the attached file over your existing includes/content/viewProd.inc.php file.

viewProd.inc.php (25.35K)
Number of downloads: 141
Method 2:
Open includes/content/viewProd.inc.php and find at around line 34:

$_GET['productId'] = sanitizeVar($_GET['productId']);

Replace with:

$_GET['productId'] = (int)sanitizeVar($_GET['productId']);

Security is our number one concern and we are pleased that we have been able to release a patch to this issue the same day it has been made aware to us. Please subscribe to this forum or follow us on Twitter to learn of important CubeCart announcements quickly.