------------------------------------------------------------------
■脆弱性の種類
-------------------------------------------------------------------
クロスサイトスクリプティングの脆弱性
-------------------------------------------------------------------
■不具合が存在するEC-CUBEのバージョン
-------------------------------------------------------------------
EC-CUBE 2.13.2以前
-------------------------------------------------------------------
■修正方法について
-------------------------------------------------------------------
/data/Smarty/templates/admin/basis/payment_inpu.tpl
/data/Smarty/templates/admin/order/status.tpl
に以下の変更を加えます。
▽payment_input.tpl
25行目付近
-------------------------------------------------------------------
変更前
-------------------------------------------------------------------
<form name="form1" id="form1" method="post" action="./payment_input.php" enctype="multipart/form-data">
<input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
<input type="hidden" name="mode" value="edit" />
<input type="hidden" name="payment_id" value="<!--{$tpl_payment_id}-->" />
<input type="hidden" name="image_key" value="" />
<input type="hidden" name="fix" value="<!--{$arrForm.fix.value}-->" />
<!--{foreach key=key item=item from=$arrHidden}-->
<input type="hidden" name="<!--{$key}-->" value="<!--{$item|h}-->" />
<!--{/foreach}-->
<input type="hidden" name="charge_flg" value="<!--{$charge_flg}-->" />
-------------------------------------------------------------------
変更後
-----------------------------------------------------------------------------------
<form name="form1" id="form1" method="post" action="./payment_input.php" enctype="multipart/form-data">
<input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
<input type="hidden" name="mode" value="edit" />
<input type="hidden" name="payment_id" value="<!--{$tpl_payment_id|h}-->" />
<input type="hidden" name="image_key" value="" />
<input type="hidden" name="fix" value="<!--{$arrForm.fix.value|h}-->" />
<!--{foreach key=key item=item from=$arrHidden}-->
<input type="hidden" name="<!--{$key}-->" value="<!--{$item|h}-->" />
<!--{/foreach}-->
<input type="hidden" name="charge_flg" value="<!--{$charge_flg|h}-->" />
=================================================================================================================
▽status.tpl
28行目付近
-------------------------------------------------------------------
変更前
-------------------------------------------------------------------
<form name="form1" id="form1" method="post" action="?" >
<input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
<input type="hidden" name="mode" value="" />
<input type="hidden" name="status" value="<!--{if $arrForm.status == ""}-->1<!--{else}--><!--{$arrForm.status}--><!--{/if}-->" />
<input type="hidden" name="search_pageno" value="<!--{$tpl_pageno}-->" />
<input type="hidden" name="order_id" value="" />
-------------------------------------------------------------------
変更後
-----------------------------------------------------------------------------------
<form name="form1" id="form1" method="post" action="?" >
<input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
<input type="hidden" name="mode" value="" />
<input type="hidden" name="status" value="<!--{if $arrForm.status == ""}-->1<!--{else}--><!--{$arrForm.status|h}--><!--{/if}-->" />
<input type="hidden" name="search_pageno" value="<!--{$tpl_pageno|h}-->" />
<input type="hidden" name="order_id" value="" />
=================================================================================================================
