Announcements
CubeCart v4 Security Patch, Cross Site Scripting Vulnerability
16/05/2009 21:49
*Please note that this issue does not affect CubeCart v3 at all.*
A cross site scripting vulnerability has been discovered with CubeCart Version 4 caused by a fault in the global sanitisation class of the ini.inc.php file.
There are two methods to patch your store:
1. Open the ini.inc.php file found in the stores root folder and find:
function safety($val) { ## strip null bytes $val = str_replace("�", '', $val); ## add slashes if magic quotes is off $val = (!get_magic_quotes_gpc()) ? addslashes($val) : $val; //return htmlspecialchars(strip_tags($val), ENT_NOQUOTES); return $val; }
Replace With:
function safety($val) { return filter_var($val, FILTER_SANITIZE_STRING, FILTER_FLAG_NO_ENCODE_QUOTES); }
2. Please upgrade to CubeCart 4.3.1-pl1 which is a patch level release of CubeCart 4.3.1 containing this code patch. This can be found in your customer area.
More information about this security issue can be found at http://forums.cubecart.com/index.php?showtopic=38261?read=1
