脆弱性

-------------------------------------------------------------------
■脆弱性の種類
-------------------------------------------------------------------
クロスサイトスクリプティング、及びセッション固定に関する脆弱性


-------------------------------------------------------------------
■不具合が存在するEC-CUBEのバージョン
-------------------------------------------------------------------
EC-CUBE　2.11.0 以降 (2011年3月23日公開～)

-------------------------------------------------------------------
■修正方法について(以下は Ver2.12.3 の修正となっております。)
-------------------------------------------------------------------
/data/class/pages/cart/LC_Page_Cart.php::action
に以下の変更を加えます。

※修正ファイルの詳細はこちらをご確認ください
http://www.ec-cube.net/info/weakness/20130522/index.php

▽LC_Page_Cart.php
89行目付近
-----------------------------------------------------------------------------------------------------------------
 変更前
-----------------------------------------------------------------------------------------------------------------
$objFormParam = $this->lfInitParam($_REQUEST); 
-----------------------------------------------------------------------------------------------------------------

-----------------------------------------------------------------------------------------------------------------
 変更後
-----------------------------------------------------------------------------------------------------------------
$objFormParam = $this->lfInitParam($_POST); 
-----------------------------------------------------------------------------------------------------------------


▽LC_Page_Cart.php
91行目付近
-----------------------------------------------------------------------------------------------------------------
 変更前
-----------------------------------------------------------------------------------------------------------------
$this->mode = $this->getMode(); 

$this->cartKeys = $objCartSess->getKeys(); 
-----------------------------------------------------------------------------------------------------------------

-----------------------------------------------------------------------------------------------------------------
 変更後
-----------------------------------------------------------------------------------------------------------------
$this->mode = $this->getMode(); 
 
// モバイル対応 
if(SC_Display_Ex::detectDevice() == DEVICE_TYPE_MOBILE) { 
    if(isset($_GET['cart_no'])) $objFormParam->setValue('cart_no', $_GET['cart_no']); 
    if(isset($_GET['cartKey'])) $objFormParam->setValue('cartKey', $_GET['cartKey']); 
}


$this->cartKeys = $objCartSess->getKeys(); 
-----------------------------------------------------------------------------------------------------------------


▽LC_Page_Cart.php
91行目付近
-----------------------------------------------------------------------------------------------------------------
 変更前
-----------------------------------------------------------------------------------------------------------------

$cart_no = $objFormParam->getValue('cart_no'); 
$cartKey = $objFormParam->getValue('cartKey'); 

switch ($this->mode) { 
-----------------------------------------------------------------------------------------------------------------

-----------------------------------------------------------------------------------------------------------------
 変更後
-----------------------------------------------------------------------------------------------------------------

$cart_no = $objFormParam->getValue('cart_no'); 
$cartKey = $objFormParam->getValue('cartKey'); 

// エラーチェック 
$arrError = $objFormParam->checkError(); 
if(isset($arrError) && !empty($arrError)) { 
    SC_Utils_Ex::sfDispSiteError(CART_NOT_FOUND); 
    SC_Response_Ex::actionExit(); 
} 

switch ($this->mode) { 
-----------------------------------------------------------------------------------------------------------------


▽LC_Page_Cart.php
215行目付近(※2.11.0,2.11.1では対応不要となります。)
-----------------------------------------------------------------------------------------------------------------
 変更前
-----------------------------------------------------------------------------------------------------------------
$objFormParam->addParam('数量', 'quantity', INT_LEN, 'n', array('EXIST_CHECK', 'ZERO_CHECK', 'NUM_CHECK', 'MAX_LENGTH_CHECK'));
-----------------------------------------------------------------------------------------------------------------

-----------------------------------------------------------------------------------------------------------------
 変更後
-----------------------------------------------------------------------------------------------------------------
$objFormParam->addParam('数量', 'quantity', INT_LEN, 'n', array('ZERO_CHECK', 'NUM_CHECK', 'MAX_LENGTH_CHECK'));
-----------------------------------------------------------------------------------------------------------------

下記のリビジョンで修正
http://svn.ec-cube.net/open_trac/changeset/22604
http://svn.ec-cube.net/open_trac/changeset/22804
http://svn.ec-cube.net/open_trac/changeset/22805