osCMax Security Update - XSS flaw patched

[michael_s]

This is for osCMax only, not osCommerce.

If you have installed the mod Printable Catalog into your standard osCommerce shop, go to addons.oscommerce.com and download the v3.6 printable catalog mod and use it to update your site.

If you have not installed Printable Catalog on your shop, this does not apply to you.

FTP upload the included file to the /catalog/templates/fallback/content/ directory, overwriting the existing file.

im using the oscommerce-2.2rc2a ..didnt find template directory ..so ..
where do i overwrite the file?

[DreamOn2003]

Thanks a lot for the patch, but thanks for using pm also

[jpf]

FTP upload the included file to the /catalog/templates/fallback/content/ directory, overwriting the existing file.

im using the oscommerce-2.2rc2a ..didnt find template directory ..so ..
where do i overwrite the file?

This is a osCMax release! Not a osCommerce RC2 release -----they don't have/use templates.

[Dranoel]

Thanks for the security message--- file updated and works great!

[johnedgley]

Many thanks for the pm and the speedy fix - much appreciated!

[chevelle]

Hello Michael,

Sorry about the post to your Profile Page - Didn't know I should post this in the forum.


Trying to install the security fix dated Jan. 27, 2009.

Cart version v2.2 RC2 installed via Cpanel.

I don't see the path or file name via ftp.

/catalog/templates/fallback/content/

When viewing the cart I don't see a printable catalog link either.

Thanks,
Steve Boyd
Tucson, Arizona

[mfleeson]

Hey Chevelle

The fix is only for oscmax users. 2.2RC2 is an oscommerce release so doesnt have templates.

Best Wishes

Mark

[michael_s]

Steve, like Mark said, osCommerce 2.2RC2a is not affected by this security problem unless you manually added the Printable Catalog (any version prior to v3.6 which is the patch we released) to your osCommerce store.

If you are not using osCMax, and don't have printable catalog installed, you are safe from this one.

[farhang_roosta]

thanks thanks

[heatherk]

if this isn't fixed on the site, would it allow someone to upload files to your site - we recently had a site compromised and we're trying to figure out how they got in.