v1.2.7 has been released!

[cpradio]

The next version of cpCommerce has been released to 1) provide better Url Rewriting support for servers running apache in a Microsoft Windows environment and 2) to correct a security vulnerability that would give an attacker the ability to forcefully login as an administrator without entering the correct email address or password.

I highly recommend that everyone upgrade to this version to secure a site running 1.2.6.

You can download the new version at the downloads page

As always, there is a patch file located in each Zip file.  If you have customizations, you can use a program like WinMerge to help merge the changes of 1.2.7 into your custom cpCommerce.

[cpradio]

I should mention that this vulnerability will only give admin rights, so the worst a hacker could do is modify your store contents.  They can't physically hack the website, change files, etc.  They can modify products, categories, manufacturers, announcements, purchases, etc.

The vulnerability is based on the URL Rewrite changes implemented.  If you do not use this functionality, you might not be affected, but I can't confirm or deny that at this moment.  I plan to also add more security around this settings to avoid future attacks against it in 1.2.8.

Again, I urge everyone to update their site, and I also urge them to remove any version/software name that appears in the template.  For example, I would remove the Powered By statement at the bottom.  Having it off the template will make it harder for a hacker to identify what software you are running.

Matt

[cpradio]

It has come to my attention that by utilizing the exploit in v1.2.6 (again this is slightly dependent on server configurations and whether or not you use the URL Rewrite module), the attacker once gaining Administrative privileges can upload a file with malicious content by altering your configuration settings to allow uploading of php files.

The attacker then just needs to execute the file.  Changes will be made to do the following in 1.2.8:
1) Make the code in _functions.php a bit more secure (it is secure in 1.2.7, but I can improve on it further)
2) All uploaded files will be chmoded to 0444 (read-only), thus preventing any execution of the files.

Matt