Zen Cart v1.2.0-l10n-jp-6 SQL Injection PATCH Released Apr 10, 2008
====================================================================

ߥ˥ƥǼġhttp://zen-cart.jp/bbs/viewtopic.php?t=2656ˤ
ΤäSQL Injectionȼv1.2.0-l10n-jp-6  кѥåǤ

ޤƱ
 - ܲ(http://www.zen-cart.com/)Υåץ졼ɤβȤ߹ޤ줿
   ͷͤη㥹
 - ܲȤǥƥ򶯲ܺȤư⤵Ƥ
     Re: Security Patches for v1.2.x
     http://www.zen-cart.com/forum/showthread.php?t=43579
кɲäƤޤ

zipեȤϰʲˤʤޤ
zen-cart-v1.2.0-l10n-jp-6-sqlinjection.patch
includes/functions/functions_lookups.php
includes/classes/shopping_cart.php
includes/modules/order_total/ot_coupon.php


ѥåŬѼ
==============

ѥåŬѤGNU diffѥåѤŬѤˡȽäե
֤ˡޤ

1. GNU diffѤˡ

zen-cart-v1.2.0-l10n-jp-6-sqlinjection.patchŬѤޤ
patchޥɤȤĶǡȼޥԤƤʤ

  $ cd /to/your/shop/root/
  $ patch -p0 < zen-cart-v1.2.0-l10n-jp-6-sqlinjection.patch

ŬѤǤޤ
patchޥɤȤʤĶ䡢ȼΥޥԤƤǤ
zen-cart-v1.2.0-l10n-jp-6-sqlinjection.patchȤǧƼȤǳƥե
˽ŬѤɬפޤ

zen-cart-v1.2.0-l10n-jp-6-sqlinjection.patchˤäƽեϤʤ
Υåץ롼۲ΰʲ3ĤΥեǤ
includes/functions/functions_lookups.php
includes/classes/shopping_cart.php
includes/modules/order_total/ot_coupon.php

2. ե֤ˡ

ʤΥåפ

includes/functions/functions_lookups.php
includes/classes/shopping_cart.php
includes/modules/order_total/ot_coupon.php

ܥѥåƱƤƱ̾Υե֤ޤ
ȼΥޥԤƤGNU diffѤˡ
Ʊͤ˥եνʬǧʤȤǳƥե˽Ŭ
ɬפޤΥեǥС饤ɤѤƤ
ե뤬ϡС饤ɤˤäͥŪɤ߹ޤƤ
ե˥ѥåŬѤɬפޤΤդɬפǤGNU diff
ѻ⥪С饤ɤѤƤϤդƤϤޤޤˡ


ѥåŬѤγǧ
====================

ܥѥåϥߥ˥ƥǼġhttp://zen-cart.jp/bbs/viewtopic.php?t=2656ˤ
ΤäSQL InjectionФкǤޤƱ
 - ܲ(http://www.zen-cart.com/)Υåץ졼ɤβȤ߹ޤ줿
   ͷͤη㥹
 - http://www.zen-cart.com/forum/showthread.php?t=435791.2.x˿侩줿к
Ǥꡢ϶ŪȼݤκƸȤƤޤ

ΤᡢǤϥߥ˥ƥǼĤΤäSQL Injectionȼ

  http://zen-cart.jp/bbs/viewtopic.php?t=2656

кγǧΤߤԤޤ

1. TEXTפξʥץľʤ

2. 1ʤξʾܺٲ(main_page=product_info)˥
   ɽTEXTץˡ\פޤͤϤ
   Ȥܥ򲡤ޤ

3. 2饫Ȳ̤ܤ˲̤
     You have an error in your SQL syntax;
   ȤäSQL顼Υ顼åɽʤȤǧޤ
   2ͤTEXTץͤȤƤΤޤɽƤ뤳Ȥǧޤ

4. 3餽Τޤ޾ʤι³ʤƤޤǽǧ(
   main_page=checkout_confirmation)3Ʊͤ2ͤTEXT
   ץͤȤƤΤޤɽƤ뤳Ȥǧޤ

5. 4³λޤθ塢ޥڡʸ
   ʸܺٲ(main_page=account_history_info)˥
   3Ʊͤ2ͤTEXTץͤȤƤΤޤɽ
   뤳Ȥǧޤ

6. 5̤˥󤷡̤[ܵҡʸδ]
   ->[ʸ]˥ʸԽ̤ܤޤ
   3Ʊͤ2ͤTEXTץͤȤƤΤޤ
   ɽƤ뤳Ȥǧޤ

7. 6顢ʸ[Ǽʽ][ɽ]˥줾β̤
   ơ3Ʊͤ2ͤTEXTץͤȤƤΤޤɽ
   뤳Ȥǧޤ



====

ΥѥåŬѤϼǤǹԤäƤ
ޤΥѥåŬѤˤʤΥƥХåå
뤳Ȥ˺ʤǤ


                                         Zen-Cart.JP <dev@zen-cart.jp>
