Is Magento CE 1.3 vulnerable to Shoplift?

[denialdesign]

A client of mine runs Magento CE 1.3. Is this vulnerable to the shoplift bug? There's no patch for versions prior to 1.4.

We're in the process of upgrading his site but I need to know if it's vulnerable in the short term.

His Magento install is in a subdirectory of his site so the shoplift.byte.nl page can't determine if the site is vulnerable.

[gwillem · Accepted solution]

Yes, 1.3 is also susceptible to Shoplift. Test here for Shoplift

And here are 1.3 patches: https://www.nublue.co.uk/blog/magento-remote-code-execution-bug-patches-for-pre-1-6-versions/