Zen Cart 1.3.7 Security PCI Update - Full

Zen Cart Security PCI Update for 1.3.7

We will completely patch your Zen Cart version 1.3.7 with the following patches and security fixes as set forth by Zen Cart.

This service includes additional security settings and Zen Cart services as noted below:

• XSS Vulnerability in v1.3.7 4/24/2007 – An XSS vulnerability in Zen Cart 1.3.7 (and prior versions) was discovered. The vulnerability only affects those people using the special TEXT input attribute on their products. The problem arises due to insufficient cleansing of outputs.
• Admin Security Version 1.3.7 7/1/2007 – In Zen Cart v1.2 through v1.3.7 an admin vulnerability exists which could let a rogue user login to your admin area unmonitored.
• File Inclusion vulnerability 7/12/2008 – Recently a vulnerability in Zen Cart v1.3.x was announced on a few Security Forums (10-JUL-2008). This purported to be a Local File Inclusion vulnerability in 2 scripts in the Zen Cart Admin.
• PCI Patch for Low Priority Warnings on Search June 27, 2009 – There are some reports of sites failing PCI scans due to an error message that can appear on the search screen if someone attempts to do a SQL injection attack. While the attack fails, an error message appears which, to the purists, discloses the name of the database table and thus gets flagged as a problem. While it’s a minor issue and poses no actual direct vulnerability, the PCI scan will fail.
• The write ability (file permissions) for your Zen Cart configure and other installation files will be verified proper and corrected if need be and possible.
  
• We will verify the deletion of your Zen Cart installation folder and rename your admin directory.
• We will check your Zen Cart configuration for common security misconfiguration and repair/advise as possible.
• SQL Injection Protection 9/19/2008:  A vulnerability in Zen Cart has been identified (thanks to Gulftech Security Research) which could potentially allow rogue behavior if the site has magic_quotes_gpc turned off in their server/site's PHP settings.
  
• IMPORTANT Security Alert: Remove extra folders from your server after install 11/28/2009
• Security Patch 6/19/2009: A SERIOUS vulnerability has been discovered in the admin section of v1.3.8 (and previous versions). To take advantage of this vulnerability any attacker must know the URL of your admin section. As our security recommendations point out, you should change the folder that your admin resides in as soon as you installed Zen Cart.
  
• XSS protection patch - 11/30/2009 - While XSS or CSRF attacks are difficult to trigger and may not manifest very often, it is still important to protect against the ill effects which could be caused by them.
• Discourage Hackers :  In older versions of Zen Cart there was a vulnerability in the code which was announced to the hacker world. Even though that has been fixed in subsequent versions, newbie hackers continue to attempt to find sites which have the vulnerability, thus wasting your time and energy worrying about what they're up to.  Their access attempts also waste some of your website server resources. 
  

Note that this service requires full access to complete, this includes hosting control panel, FTP and Zen Cart admin. DO NOT send your access information in the comments of your order, we will send you a secure form to provide your information.

This patch installation and security service is NOT available for Windows servers and some Cloud and Plesk Hosting Environments may have additional fees to complete the work. If this is the case you will be notified upfront of the additional project cost and can request to cancel your order if you like at that time. This service is currently ONLY available for 1.3.7 version of Zen Cart, but does not meet PCI compliance as you are required to upgrade to maintain a secure shopping environment and PCI compliance.