4

I installed SUPEE-7405 and everything appeared to go smoothly with no errors, however I tested out the exploit described here and to my horror the site still allows me to create an account with an email address like:

"<script>alert(1);</script>"@example.com

I would assume that whatever file was changed to fix APPSEC-1213 is being overridden by an extension somewhere, but how can I even find out what file was changed to fix APPSEC-1213?

  • It allows you to create an account, but does it pop alert in the backend when you view the address? – Fiasco Labs Jan 25 '16 at 18:20
  • Yes, it still creates a popup containing the number 1. – Christian Jan 25 '16 at 18:21
  • admin, why did you edit the post? that > character your removed is necessary for the exploit to work – Christian Jan 25 '16 at 18:25
  • This extension is secure and alternative of cart2quote magecomp.com/magento-email-cart.html – Gaurav Jain Apr 14 '17 at 5:40
5

For anyone wondering, the fix for this exploit was in app/design/adminhtml/default/default/template/sales/order/view/info.phtml and that template was being overridden by cart2quote. Anyone using cart2quote on their magento site should be aware that they are still vulnerable to APPSEC-1213 even after installing SUPEE-7405

  • Figuring it was something like that, the fix was to escapeHtml() the output in any display template. If Javascript is on, the email address is validated and rejected normally to prevent storage, but can be bypassed. Now the bypass shouldn't work as long as any email address display is properly html tag stripped. – Fiasco Labs Jan 25 '16 at 18:40
  • So let me know if I'm understanding the fact... the patch does not prevent a customer registration with this javascript code... just prevent the execution in the admin view? – MauroNigrele Jan 26 '16 at 8:51
  • That is correct MauroNigrele. – Christian Jan 26 '16 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.