Cross-site scripting vulnerability, update available, Security update Options

[Russ McRee]

Cross-site scripting (XSS) occurs where the "step_id" and "CHECKOUT_CZ_BLOWFISH_KEY" variables don't properly sanitize input submitted to the checkout.php script.
This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

http://holisticinfosec.org/content/view/81/45/

Current fix is to replace the file avactis-system/core/request.php with the attached one.
After a new version is released this bug fix will be available with the update script.

Attached File(s)

 request.php ( 16.48K ) Number of downloads: 595

 

[Alex Girin]

Hi Russ,

Thank you for your post.

This patch is approved and can be applied for versions 1.8.0 and 1.8.1.

If you have earlier versions of Avactis, please contact Support.

Best Regards,
Alex Girin
Avactis Shopping Cart Team

[IsabelHotchins]

thanks. very helpful post. I read a few of your other posts and they all helped me.