-------------------------------------------------------------------
■脆弱性の種類
-------------------------------------------------------------------
クロスサイトスクリプティング、及びセッション固定に関する脆弱性
-------------------------------------------------------------------
■不具合が存在するEC-CUBEのバージョン
-------------------------------------------------------------------
EC-CUBE 2.11.0 以降 (2011年3月23日公開~)
-------------------------------------------------------------------
■修正方法について(以下は Ver2.12.3 の修正となっております。)
-------------------------------------------------------------------
/data/class/pages/cart/LC_Page_Cart.php::action
に以下の変更を加えます。
※修正ファイルの詳細はこちらをご確認ください
http://www.ec-cube.net/info/weakness/20130522/index.php
▽LC_Page_Cart.php
89行目付近
-----------------------------------------------------------------------------------------------------------------
変更前
-----------------------------------------------------------------------------------------------------------------
$objFormParam = $this->lfInitParam($_REQUEST);
-----------------------------------------------------------------------------------------------------------------
-----------------------------------------------------------------------------------------------------------------
変更後
-----------------------------------------------------------------------------------------------------------------
$objFormParam = $this->lfInitParam($_POST);
-----------------------------------------------------------------------------------------------------------------
▽LC_Page_Cart.php
91行目付近
-----------------------------------------------------------------------------------------------------------------
変更前
-----------------------------------------------------------------------------------------------------------------
$this->mode = $this->getMode();
$this->cartKeys = $objCartSess->getKeys();
-----------------------------------------------------------------------------------------------------------------
-----------------------------------------------------------------------------------------------------------------
変更後
-----------------------------------------------------------------------------------------------------------------
$this->mode = $this->getMode();
// モバイル対応
if(SC_Display_Ex::detectDevice() == DEVICE_TYPE_MOBILE) {
if(isset($_GET['cart_no'])) $objFormParam->setValue('cart_no', $_GET['cart_no']);
if(isset($_GET['cartKey'])) $objFormParam->setValue('cartKey', $_GET['cartKey']);
}
$this->cartKeys = $objCartSess->getKeys();
-----------------------------------------------------------------------------------------------------------------
▽LC_Page_Cart.php
91行目付近
-----------------------------------------------------------------------------------------------------------------
変更前
-----------------------------------------------------------------------------------------------------------------
$cart_no = $objFormParam->getValue('cart_no');
$cartKey = $objFormParam->getValue('cartKey');
switch ($this->mode) {
-----------------------------------------------------------------------------------------------------------------
-----------------------------------------------------------------------------------------------------------------
変更後
-----------------------------------------------------------------------------------------------------------------
$cart_no = $objFormParam->getValue('cart_no');
$cartKey = $objFormParam->getValue('cartKey');
// エラーチェック
$arrError = $objFormParam->checkError();
if(isset($arrError) && !empty($arrError)) {
SC_Utils_Ex::sfDispSiteError(CART_NOT_FOUND);
SC_Response_Ex::actionExit();
}
switch ($this->mode) {
-----------------------------------------------------------------------------------------------------------------
▽LC_Page_Cart.php
215行目付近(※2.11.0,2.11.1では対応不要となります。)
-----------------------------------------------------------------------------------------------------------------
変更前
-----------------------------------------------------------------------------------------------------------------
$objFormParam->addParam('数量', 'quantity', INT_LEN, 'n', array('EXIST_CHECK', 'ZERO_CHECK', 'NUM_CHECK', 'MAX_LENGTH_CHECK'));
-----------------------------------------------------------------------------------------------------------------
-----------------------------------------------------------------------------------------------------------------
変更後
-----------------------------------------------------------------------------------------------------------------
$objFormParam->addParam('数量', 'quantity', INT_LEN, 'n', array('ZERO_CHECK', 'NUM_CHECK', 'MAX_LENGTH_CHECK'));
-----------------------------------------------------------------------------------------------------------------
下記のリビジョンで修正
http://svn.ec-cube.net/open_trac/changeset/22604
http://svn.ec-cube.net/open_trac/changeset/22804
http://svn.ec-cube.net/open_trac/changeset/22805