Site still vulnerable to APPSEC-1213 after installing SUPEE-7405
-
09-12-2020 - |
سؤال
I installed SUPEE-7405 and everything appeared to go smoothly with no errors, however I tested out the exploit described here and to my horror the site still allows me to create an account with an email address like:
"<script>alert(1);</script>"@example.com
I would assume that whatever file was changed to fix APPSEC-1213 is being overridden by an extension somewhere, but how can I even find out what file was changed to fix APPSEC-1213?
المحلول
For anyone wondering, the fix for this exploit was in app/design/adminhtml/default/default/template/sales/order/view/info.phtml and that template was being overridden by cart2quote. Anyone using cart2quote on their magento site should be aware that they are still vulnerable to APPSEC-1213 even after installing SUPEE-7405
لا تنتمي إلى magento.stackexchange