XSS protection patch - Nov 30 2009

[NewsBot]

XSS protection patch - Nov 30 2009
30 November 2009, 5:14 pm

While XSS or CSRF attacks are difficult to trigger and may not manifest very often, it is still important to protect against the ill effects which could be caused by them.

As such, the following XSS patches are advised in order to protect yourself from a recently-reported vulnerability:

The following edits should be made to the respective files.

THESE UPDATES APPLY TO ALL VERSIONS OF ZEN CART UP TO (& including)v1.3.8a (although line numbers may vary)

NOTE: These updates should be made EVEN if you've renamed your admin folder. (Merely renaming your admin folder will NOT protect you from XSS issues.)

/admin/index.php

Add the new lines shown, around approx line 135:

Code:

  while (!$customers->EOF) {

            $customers->fields['customers_firstname'] = zen_output_string_protected($customers->fields['customers_firstname']);

            $customers->fields['customers_lastname'] = zen_output_string_protected($customers->fields['customers_lastname']);

    echo '              

/admin/sqlpatch.php  (ONLY relevant for v1.3.5 to (including) v1.3.8a)

Add the "(bool)" as shown here on line 808:

Code:

'; ?>

Thanks to Pedro Joaquín at webvuln for the alert.



Source: Zen Cart Support - Zen Cart Release Announcements