Zen Cart v1.3.0.2-l10n-jp-2 XSS PATCH Released May 20, 2007
====================================================================

ܲ(http://www.zen-cart.com/)ǥʥ󥹤줿XSSȼ
v1.3.0.2-l10n-jp-2  кѥåǤ

zipեȤϰʲˤʤޤ
zen-cart-v1.3.0.2-l10n-jp-2-xss.patch
admin/invoice.php
admin/orders.php
admin/packingslip.php
includes/modules/pages/shopping_cart/header_php.php
includes/templates/template_default/templates/tpl_account_history_info_default.php
includes/templates/template_default/templates/tpl_checkout_confirmation_default.php

ѥåŬ
==============

ѥåŬGNU diffѥåѤŬˡȽäե
֤ˡޤ

1. GNU diffѤˡ

zen-cart-v1.3.0.2-l10n-jp-2-xss.patchŬޤ
patchޥɤȤĶǡȼޥԤƤʤ

  $ cd /to/your/shop/root/
  $ patch -p0 < zen-cart-v1.3.0.2-l10n-jp-2-xss.patch

ŬǤޤ
patchޥɤȤʤĶ䡢ȼΥޥԤƤǤ
zen-cart-v1.3.0.2-l10n-jp-2-xss.patchȤǧƼȤǳƥե
˽Ŭɬפޤ

zen-cart-v1.3.0.2-l10n-jp-2-xss.patchˤäƽեϤʤ
Υåץ롼۲ΰʲ6ĤΥեǤ
admin/invoice.php
admin/orders.php
admin/packingslip.php
includes/modules/pages/shopping_cart/header_php.php
includes/templates/template_default/templates/tpl_account_history_info_default.php
includes/templates/template_default/templates/tpl_checkout_confirmation_default.php

2. ե֤ˡ

ʤΥåפ

admin/invoice.php
admin/orders.php
admin/packingslip.php
includes/modules/pages/shopping_cart/header_php.php
includes/templates/template_default/templates/tpl_account_history_info_default.php
includes/templates/template_default/templates/tpl_checkout_confirmation_default.php

ܥѥåƱƤƱ̾Υե֤ޤ
ȼΥޥԤƤGNU diffѤˡ
Ʊͤ˥եνʬǧʤȤǳƥե˽Ŭ
ɬפޤäȼƥץ졼ȤѤƤϡ

  includes/templates/template_default/

ǤϤʤ

  includes/templates/[ʤȼƥץ졼̾]/

۲ΥեŬɬפˤʤޤΤդɬפǤGNU diffѻ
ȼƥץ졼̾ѤƤϤդƤϤޤޤˡ


ѥåŬγǧ
====================

ܥѥåTEXTפξʥץXSSȼΤǤ
 äTEXTפξʥץѤƤʤåפǤ
   ȼƤޤ

ѥåŬԤ줿Ȥǧˤϰʲμ»ܤ
ʤʲμǤϥ֥饦JavaScriptɬOnˤ
                                        ~~~~~~~~~~~~~~~~~~~~
ԤäƤ

1. TEXTפξʥץľʤ
   (ǥǡǤ
      [ʥץγƼ勵]
        > [TEXT]
          > [1̾쥪ץ1ʸ]
    ʤɤ뾦ʤˤʤޤ

2. 1ʤξʾܺٲ(main_page=product_info)˥
   ɽTEXTץ
     <script>alert('XSS is occur!');</script>
   ϤơȤܥ򲡤ޤ

3. 2饫Ȳ̤ܤJavaScriptΥ顼Ȥ[XSS is occur!]
   Ȥåȶɽ줺2ͤTEXTץ
   ȤƤΤޤɽƤ뤳Ȥǧޤ

4. 3餽Τޤ޾ʤι³ʤƤޤǽǧ(
   main_page=checkout_confirmation)3ƱͤJavaScriptΥ顼
   ɽ줺2ͤTEXTץͤȤƤΤޤɽ
   Ƥ뤳Ȥǧޤ

5. 4³λޤθ塢ޥڡʸ
   ʸܺٲ(main_page=account_history_info)˥
   3ƱͤJavaScriptΥ顼Ȥɽ줺2ͤTEXT
   ץͤȤƤΤޤɽƤ뤳Ȥǧޤ

6. 5̤˥󤷡̤[ܵҡʸδ]
   ->[ʸ]˥JavaScriptΥ顼ȤɽʤȤ
   ǧޤޤʸԽ̤ܤ3ƱͤJavaScript
   顼Ȥɽ줺2ͤTEXTץͤȤƤΤޤ
   ɽƤ뤳Ȥǧޤ

7. 6顢ʸ[Ǽʽ][ɽ]˥줾β̤
   ơ3ƱͤJavaScriptΥ顼Ȥɽ줺2ͤTEXT
   ץͤȤƤΤޤɽƤ뤳Ȥǧޤ



====

ΥѥåŬϼǤǹԤäƤ
ޤΥѥåŬˤʤΥƥХåå
뤳Ȥ˺ʤǤ


                                         Zen-Cart.JP <dev@zen-cart.jp>
