-------------------------------------------------------------------
■脆弱性の種類
-------------------------------------------------------------------
パスワードリマインド機能における不適切な入力確認の脆弱性


-------------------------------------------------------------------
■不具合が存在するEC-CUBEのバージョン
-------------------------------------------------------------------
EC-CUBE　2.11.0 以降 (2011年3月23日公開～)

-------------------------------------------------------------------
■修正方法について(以下は Ver2.12.3 の修正となっております。)
-------------------------------------------------------------------
/data/class/pages/forgot/LC_Page_Forgot.php::lfCheckForgotMail
/data/class/pages/forgot/LC_Page_Forgot.php::lfCheckForgotSecret
に以下の変更を加えます。

※修正ファイルの詳細はこちらをご確認ください
http://www.ec-cube.net/info/weakness/20130522/index.php

▽LC_Page_Forgot.php
157行目付近
-----------------------------------------------------------------------------------------------------------------
 変更前
-----------------------------------------------------------------------------------------------------------------
errmsg = NULL; 
$objQuery =& SC_Query_Ex::getSingletonInstance(); 
$where = '(email Like ? OR email_mobile Like ?) AND name01 Like ? AND name02 Like ? AND del_flg = 0'; 
-----------------------------------------------------------------------------------------------------------------

-----------------------------------------------------------------------------------------------------------------
 変更後
-----------------------------------------------------------------------------------------------------------------
errmsg = NULL; 
$objQuery =& SC_Query_Ex::getSingletonInstance(); 
$where = '(email = ? OR email_mobile = ?) AND name01 = ? AND name02 = ? AND del_flg = 0';
-----------------------------------------------------------------------------------------------------------------

▽LC_Page_Forgot.php
207行目付近
-----------------------------------------------------------------------------------------------------------------
 変更前
-----------------------------------------------------------------------------------------------------------------
$table = 'dtb_customer'; 
$where = '(email Like ? OR email_mobile Like ?)'
        . ' AND name01 Like ? AND name02 Like ?'
-----------------------------------------------------------------------------------------------------------------

-----------------------------------------------------------------------------------------------------------------
 変更後
-----------------------------------------------------------------------------------------------------------------
$table = 'dtb_customer'; 
$where = '(email = ? OR email_mobile = ?)'
        . ' AND name01 = ? AND name02 = ?'
-----------------------------------------------------------------------------------------------------------------

下記のリビジョンで修正
http://svn.ec-cube.net/open_trac/changeset/22580