-------------------------------------------------------------------
■脆弱性の種類
-------------------------------------------------------------------
パスワードリマインド機能における不適切な入力確認の脆弱性
-------------------------------------------------------------------
■不具合が存在するEC-CUBEのバージョン
-------------------------------------------------------------------
EC-CUBE 2.11.0 以降 (2011年3月23日公開～)
-------------------------------------------------------------------
■修正方法について(以下は Ver2.12.3 の修正となっております。)
-------------------------------------------------------------------
/data/class/pages/forgot/LC_Page_Forgot.php::lfCheckForgotMail
/data/class/pages/forgot/LC_Page_Forgot.php::lfCheckForgotSecret
に以下の変更を加えます。
※修正ファイルの詳細はこちらをご確認ください
http://www.ec-cube.net/info/weakness/20130522/index.php
▽LC_Page_Forgot.php
157行目付近
-----------------------------------------------------------------------------------------------------------------
変更前
-----------------------------------------------------------------------------------------------------------------
errmsg = NULL;
$objQuery =& SC_Query_Ex::getSingletonInstance();
$where = '(email Like ? OR email_mobile Like ?) AND name01 Like ? AND name02 Like ? AND del_flg = 0';
-----------------------------------------------------------------------------------------------------------------
-----------------------------------------------------------------------------------------------------------------
変更後
-----------------------------------------------------------------------------------------------------------------
errmsg = NULL;
$objQuery =& SC_Query_Ex::getSingletonInstance();
$where = '(email = ? OR email_mobile = ?) AND name01 = ? AND name02 = ? AND del_flg = 0';
-----------------------------------------------------------------------------------------------------------------
▽LC_Page_Forgot.php
207行目付近
-----------------------------------------------------------------------------------------------------------------
変更前
-----------------------------------------------------------------------------------------------------------------
$table = 'dtb_customer';
$where = '(email Like ? OR email_mobile Like ?)'
. ' AND name01 Like ? AND name02 Like ?'
-----------------------------------------------------------------------------------------------------------------
-----------------------------------------------------------------------------------------------------------------
変更後
-----------------------------------------------------------------------------------------------------------------
$table = 'dtb_customer';
$where = '(email = ? OR email_mobile = ?)'
. ' AND name01 = ? AND name02 = ?'
-----------------------------------------------------------------------------------------------------------------
下記のリビジョンで修正
http://svn.ec-cube.net/open_trac/changeset/22580
