ShopEx 4.5 product viewpic XSS Vulnerability and CAPTCHA Bypass Vulnerability Fix

1. product viewpic XSS vulnerability Cause: viewpic does not escape correctly, creating a vulnerability that allows cross-site scripting attacks. Fix: In core\shop\controller\ctl.product.php, find function viewpic($goodsid, $selected=’def’), and on the line below it add $goodsid = intval($goodsid); Save, and the problem is solved. 2. CAPTCHA bypass issue Cause: after the first verification of the CAPTCHA for the shopex admin login fails, the CAPTCHA stored in the session the first time is not cleared, so it can be brute-forced by retrying with a specific program. Fix: In core/admin/controller/ctl.passport.php find

$_SESSION``[``'loginmsg'``] = __(“验证码输入错误!”);

and add below it

$_SESSION``[``'RANDOM_CODE'``] = ”;

Save, and the fix is complete