Squirrelcart Security Patch #SC101201
Release date: 12/01/2010

XSS (Cross Site Scripting) vulnerability patch for Reviews module
Affected Reviews module versions: v1.0.0 - 1.0.6

How to find your version number:
---------------------------------------------------------------------
You can locate your Reviews module version number in the control panel, under the "Modules > Information" menu link.


Patch Info and Instructions
---------------------------------------------------------------------
This is a patch for protecting against a XSS (Cross Site Scripting) vulnerability that was discovered on 11/25/2010.

You can get more information on XSS vulnerabilities here: http://en.wikipedia.org/wiki/Cross-site_scripting

This would be considered a "Type 1" vulnerability, which according to Wikipedia is as follows:

	This kind of cross-site scripting hole is also referred to as a non-persistent or reflected vulnerability, and is by far the most 
	common type. These holes show up when data provided by a web client is used immediately by server-side scripts to generate a page 
	of results for that user. If unvalidated user-supplied data is included in the resulting page without HTML encoding, this will 
	allow client-side code to be injected into the dynamic page. A classic example of this is in site search engines: if one searches
	for a string which includes some HTML special characters, often the search string will be redisplayed on the result page to indicate 
	what was searched for, or will at least include the search terms in the text box for easier editing. If all occurrences of the 
	search terms are not HTML entity encoded, an XSS hole will result.

	At first blush, this does not appear to be a serious problem since users can only inject code into their own pages. 
	However, with a small amount of social engineering, an attacker could convince a user to follow a malicious URL which injects 
	code into the results page, giving the attacker full access to that page's content. Due to the general requirement of the use of 
	some social engineering in this case (and normally in Type 0 vulnerabilities as well), many programmers have disregarded these 
	holes as not terribly important. This misconception is sometimes applied to XSS holes in general (even though this is only one 
	type of XSS) and there is often disagreement in the security community as to the importance of cross-site scripting vulnerabilities.

Instructions for applying patch:
1. Backup your installation
2. Upload the "review_write.php" file from this folder to your "squirrelcart/modules/review" folder, overwriting the existing file.

If you need assistance regarding this, please contact us using our helpdesk:
https://www.ldev.com/helpdesk/