I installed SUPEE-7405 and everything appeared to go smoothly with no errors, however I tested out the exploit described here and to my horror the site still allows me to create an account with an email address like:


I would assume that whatever file was changed to fix APPSEC-1213 is being overridden by an extension somewhere, but how can I even find out what file was changed to fix APPSEC-1213?

  • It allows you to create an account, but does it pop alert in the backend when you view the address? Jan 25, 2016 at 18:20
  • Yes, it still creates a popup containing the number 1.
    – Christian
    Jan 25, 2016 at 18:21
  • admin, why did you edit the post? that > character your removed is necessary for the exploit to work
    – Christian
    Jan 25, 2016 at 18:25
  • This extension is secure and alternative of cart2quote magecomp.com/magento-email-cart.html Apr 14, 2017 at 5:40

1 Answer 1


For anyone wondering, the fix for this exploit was in app/design/adminhtml/default/default/template/sales/order/view/info.phtml and that template was being overridden by cart2quote. Anyone using cart2quote on their magento site should be aware that they are still vulnerable to APPSEC-1213 even after installing SUPEE-7405

  • Figuring it was something like that, the fix was to escapeHtml() the output in any display template. If Javascript is on, the email address is validated and rejected normally to prevent storage, but can be bypassed. Now the bypass shouldn't work as long as any email address display is properly html tag stripped. Jan 25, 2016 at 18:40
  • So let me know if I'm understanding the fact... the patch does not prevent a customer registration with this javascript code... just prevent the execution in the admin view? Jan 26, 2016 at 8:51
  • That is correct MauroNigrele.
    – Christian
    Jan 26, 2016 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.