脆弱性

------------------------------------------
脆弱性の種類
------------------------------------------
SQLインジェクション
-----------------------------------------
脆弱性のあるファイル
-----------------------------------------
data/class/pages/mypage/LC_Page_Mypage_DeliveryAddr.php
-----------------------------------------
対策
-----------------------------------------
変更前
if ($deliv_count < DELIV_ADDR_MAX or isset($_POST['other_deliv_id'])){
	$this->lfRegistData($_POST,$arrRegistColumn, $objCustomer);
}

↓

変更後
 if ($deliv_count < DELIV_ADDR_MAX or isset($_POST['other_deliv_id'])){
                        if(strlen($_POST['other_deliv_id'] != 0)){
                            $deliv_count = $objQuery->count("dtb_other_deliv","customer_id=? and other_deliv_id = ?" ,array($objCustomer->getValue('customer_id'), $_POST['other_deliv_id']));
                            if ($deliv_count == 0) {
                                SC_Utils_Ex::sfDispSiteError(CUSTOMER_ERROR);
                            }else{
                                $this->lfRegistData($_POST,$arrRegistColumn, $objCustomer);                                
                            }
                        }else{
                            $this->lfRegistData($_POST,$arrRegistColumn, $objCustomer);                            
                        }
                    }