Squirrelcart Security Patch #SC140311
Release date: 03/11/2014

FCKEditor vulnerability patch
Affected Squirrelcart versions: v2.0.0 - 3.5.8
Squirrelcart v4.0.0 and newer are not affected.

How to find your version number:
---------------------------------------------------------------------
You can locate your Squirrelcart version in the upper right hand corner of your control panel.


Patch Info and Instructions
---------------------------------------------------------------------
This is a patch which will upgrade FCKEditor to version 2.6.10, which is the last 2.x version released.

FCKEditor is a free script that we use for the rich text editor seen on some records in the control panel of Squirrelcart. 
Squirrelcart versions 3.4.0 - 3.5.8 use FCKEditor version 2.6.6. Squirrelcart versions 3.3.7 and older use earlier versions of FCKEditor.

This patch is to address two vulnerabilities in FCKEditor:
http://osvdb.org/show/osvdb/83278
http://osvdb.org/show/osvdb/89282

While this patch should protect against these vulnerabilities, it's always a good idea to keep your installation up to date. 
Upgrading to the latest Squirrelcart release (v4.3.1 as of this writing) will provide protection against this vulnerability and also fix all known bugs to date. 

If you are using Squirrelcart version 2.x, you should upgrade to the latest version.
If you are running version 3.0.0 - 3.5.8 and prefer not to upgrade, you can apply this patch by following the instructions below. 

CAUTION: If using Squirrelcart versions 3.0.0 - 3.3.7, this patch will cause the rich text editor to no longer function in Internet Explorer.

Instructions for applying patch for versions 3.0.0 - 3.5.8:
1. Backup your installation
2. Delete the "squirrelcart/lib/fckeditor" folder from your server
3. Upload the "squirrelcart" folder from inside the "upload" folder in this zip file to the location on your server folder that contains your squirrelcart folder


If you need assistance regarding this, please contact us using our helpdesk:
https://www.ldev.com/helpdesk/