Creloaded sites vulernable to URL change exploit, please patch your site ASAP

There is a discussion over at SP about SERIOUS CRE Loaded Security Issue Revealed which affects 1000s of stores affected. Better hurry and patch yours if yours is among them!

 

Here is the fix:

in the file admin/includes/application_top.php


Simply find the line:

$PHP_SELF = (isset($_SERVER['PHP_SELF']) ? $_SERVER['PHP_SELF'] :
$_SERVER['SCRIPT_NAME']);

and replace with:
$PHP_SELF = $_SERVER['SCRIPT_NAME'];

 

thanks for provding this fix with us ..