Loaded Commerce Community

I am running CRE Loaded Pro 6.2 Pro Patch 11 and have found a security vulnerability in create_account.php. It allows for a possible SQL injection. Who can I contact about this? Thanks!

Please post the information in the bug tracker at
http://creforge.com/tracker/?atid=126&g ... unc=browse

Or, if the report contains sensitive information, please submit a support ticket at:
http://www.creloaded.com/support/tickets/?CDpath=2_77

Charles

Simpler still, just send me a private message.

Not being paranoid, how private is a security message posted over the Internet in an email? I know that it is common and accepted practice but given that many ecommerce websites run over CRE Loaded then ideally the security information could have been sent through a different channel. I have known instances of active interception of email.

Does CRE Loaded have a vulnerability disclosure policy?

Cheers

Tel

Well if inside a support ticket you see the padlock on your browser, it would be secure. As far as email goes, if you aren't using TLS/SSL over a secure email port and the server is not setup to use a commercial CA validated service certificate, your email will NOT be secured.

Let me know if you need help setting up your email client to send secure email and ensure your host accepts secure email channels.