-------------------------------------------------------------------
■脆弱性の種類
-------------------------------------------------------------------
管理画面ページでのXSS

-------------------------------------------------------------------
■不具合が存在するEC-CUBEのバージョン
-------------------------------------------------------------------
全てのバージョン(2.4系以下/2.11系/2.12系)

-------------------------------------------------------------------
■修正方法について(以下は Ver2.12.4 の修正となっております。)
-------------------------------------------------------------------
/data/Smarty/templates/admin/contents/recommend_search.tpl
/data/class/pages/admin/contents/LC_Page_Admin_Contents_RecommendSearch.php::action
に以下の変更を加えます。

※修正ファイルの詳細はこちらをご確認ください
http://www.ec-cube.net/info/weakness/20130626/index.php

▽recommend_search.tpl
31行目付近
-------------------------------------------------------------------
 変更前
-------------------------------------------------------------------
function func_submit( id ){
    var fm = window.opener.document.form<!--{$smarty.get.rank}-->;
    fm.product_id.value = id;
    fm.mode.value = 'set_item';
    fm.rank.value = '<!--{$smarty.get.rank}-->';
    fm.submit();
    window.close();
    return false;
}
-------------------------------------------------------------------

-------------------------------------------------------------------
 変更後
-------------------------------------------------------------------
function func_submit( id ){
    var fm = window.opener.document.form<!--{$rank|h}-->;
    fm.product_id.value = id;
    fm.mode.value = 'set_item';
    fm.rank.value = '<!--{$rank|h}-->';
    fm.submit();
    window.close();
    return false;
}
-------------------------------------------------------------------

▽LC_Page_Admin_Contents_RecommendSearch.php
67行目付近
-------------------------------------------------------------------
 変更前
-------------------------------------------------------------------
$objDb = new SC_Helper_DB_Ex();
$objFormParam = new SC_FormParam_Ex();
$this->lfInitParam($objFormParam);
$objFormParam->setParam($_POST);
$objFormParam->convParam();
-------------------------------------------------------------------

-------------------------------------------------------------------
 変更後
-------------------------------------------------------------------
$objDb = new SC_Helper_DB_Ex();
$objFormParam = new SC_FormParam_Ex();
$this->lfInitParam($objFormParam);
$objFormParam->setParam($_POST);
$objFormParam->convParam();

$rank = intval($_GET['rank']);
-------------------------------------------------------------------

105行目付近
-------------------------------------------------------------------
 変更前
-------------------------------------------------------------------
// カテゴリ取得
$this->arrCatList = $objDb->sfGetCategoryList();
$this->setTemplate('contents/recommend_search.tpl');
-------------------------------------------------------------------

-------------------------------------------------------------------
 変更後
-------------------------------------------------------------------
// カテゴリ取得
$this->arrCatList = $objDb->sfGetCategoryList();
$this->rank       = $rank;
$this->setTemplate('contents/recommend_search.tpl');
-------------------------------------------------------------------

下記のリビジョンで修正
http://svn.ec-cube.net/open_trac/changeset/22861