Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 19 Jan 2016 14:47:10 -0500
From: Scott Arciszewski <>
Subject: OpenCart users, switch to OpenCart-CE immediately

This commit was made against the Community Edition of OpenCart on April 2,

As you can see from the commit message, it was intended to prevent file
inclusion attacks.

It's January 19, 2016 and OpenCart proper is still doing it wrong.

What this line tries to do is prevent directory traversal attacks by
stripping out ../, but unfortunately it's quite dumb.

This also doesn't defend against NUL byte injections.

This is a 0day, because Daniel Kerr usually just flames security
researchers and I didn't feel like subjecting myself to that ever again. To


I'm sure I missed quite a few instances of him flaming people trying to
help him secure his project for free. He doesn't seem to ever learn, either.

The OpenCart-CE maintainer, in contrast, is more hospitable towards
security researchers. So in addition to already having a fix in place,
their rapport with the community means using the community edition is
likely to make your system more secure than running OpenCart proper.

In closing, I recommend everyone who runs OpenCart to switch to OpenCart-CE
today and anyone who does penetration testing read this excellent article
by Keith Makan about Ordering an RFI via Email:

Scott Arciszewski
Chief Development Officer
Paragon Initiative Enterprises <>

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.