CRE Loaded Link Page Vulnerability with beta Fix.

[David M. Graham]

Well, if I read that right, I certainly agree.   

[dorian]

JavaScript is too lag. php script too faster.
astigmatism

[David M. Graham]

You are missing my whole point, David. I am using examples.

Ok, I have the point that you meant to say something like:

"Shouldn't CRE Loaded use JavaScript to check for new updates whenever someone logs in to the Admin and notify them of new releases?"

Might have gotten it quicker if you'd just said what you meant.  Certainly the thread would scan better.

However, again -  the use of Javascript is just not necessary.  The existing ad server could do just this - with a specific ad group called only from the login page.

The ONLY advantage this offers over the existing (heavily abused) system is that it would only be presented on that page and could help avoid creating a sluggish admin and annoyed CRE Loaded users if CRE was willing to give up Admin Spamming their "captive audience".

Does that clarify things for everyone?

David

[butlimous]

You are missing my whole point, David. I am using examples.

I think that he is confused 

<spam links removed by moderator>

[inetbiz]

You are missing my whole point, David. I am using examples.

[David M. Graham]

They check to see if you are using the most up to date source.

Which has diddly to do with whether the user has turned off Javascript in their browser for security reasons.   No javascript, no feature.  Whats the point?

[inetbiz]

They check to see if you are using the most up to date source.

[David M. Graham]

It is just dicey.  I think the code may already rely too heavily on a client side technology which can be disabled.   Nor do I see what filezilla or winscp has anything to do with this.

[inetbiz]

Their next patch should take a look at the error message stack. While filezilla may be windows open source or even winscp, I think it's important to use a javascripted warn message of new updates to stock code. Do you agree or is that going over-board?

[David M. Graham]

Yes - sorry this is so belated.

CRE did issue a fix, which consists of two files - link.php and links_submit.php root files.  Archive attached.

[inetbiz]

Has there been any update to their code on this issue?

[inetbiz]

Name: CVE-2008-2557
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2557
Reference: MISC:http://oscommerceuniversity.com/lounge/index.php?topic=249.0

Cross-site scripting (XSS) vulnerability in CRE Loaded 6.2.13.1 and
earlier allows remote attackers to inject arbitrary web script or HTML
via the (1) Links and (2) Links Submit pages.

[David M. Graham]

At this time, we have one report of an actual usage of a hack based on this vulnerability.  The issue was reported to Chain Reaction and a patch is reported in the works.

David

[David M. Graham]

The issue was an unfiltered links path component - the fix was casting the incoming path to the appropriate (int) data type. 

Regards,

David

[inetbiz]

Exactly what was the discovered vulnerability in cre loaded shopping cart that allowed cross site vulnerablity in the link pages and link submission?

[David M. Graham]

Recently, a Cross Site Scripting vulnerability was discovered in the CRE Loaded Links and Links Submit pages.   This affect all versions before and including 6.2.13.1

The attached files provide a fix for this issue.



David