------------------------------------------------------------------
■脆弱性の種類
-------------------------------------------------------------------
クロスサイトスクリプティングの脆弱性

-------------------------------------------------------------------
■不具合が存在するEC-CUBEのバージョン
-------------------------------------------------------------------
EC-CUBE　2.13.2以前
	 
-------------------------------------------------------------------
■修正方法について
-------------------------------------------------------------------

/data/Smarty/templates/admin/basis/payment_inpu.tpl
/data/Smarty/templates/admin/order/status.tpl
に以下の変更を加えます。

▽payment_input.tpl
25行目付近
-------------------------------------------------------------------
 変更前
-------------------------------------------------------------------
<form name="form1" id="form1" method="post" action="./payment_input.php" enctype="multipart/form-data">
    <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
    <input type="hidden" name="mode" value="edit" />
    <input type="hidden" name="payment_id" value="<!--{$tpl_payment_id}-->" />
    <input type="hidden" name="image_key" value="" />
    <input type="hidden" name="fix" value="<!--{$arrForm.fix.value}-->" />
    <!--{foreach key=key item=item from=$arrHidden}-->
    <input type="hidden" name="<!--{$key}-->" value="<!--{$item|h}-->" />
    <!--{/foreach}-->
    <input type="hidden" name="charge_flg" value="<!--{$charge_flg}-->" />

-------------------------------------------------------------------
 変更後
-----------------------------------------------------------------------------------
<form name="form1" id="form1" method="post" action="./payment_input.php" enctype="multipart/form-data">
    <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
    <input type="hidden" name="mode" value="edit" />
    <input type="hidden" name="payment_id" value="<!--{$tpl_payment_id|h}-->" />
    <input type="hidden" name="image_key" value="" />
    <input type="hidden" name="fix" value="<!--{$arrForm.fix.value|h}-->" />
    <!--{foreach key=key item=item from=$arrHidden}-->
    <input type="hidden" name="<!--{$key}-->" value="<!--{$item|h}-->" />
    <!--{/foreach}-->
    <input type="hidden" name="charge_flg" value="<!--{$charge_flg|h}-->" />

=================================================================================================================

▽status.tpl
28行目付近
-------------------------------------------------------------------
 変更前
-------------------------------------------------------------------
<form name="form1" id="form1" method="post" action="?" >
    <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
    <input type="hidden" name="mode" value="" />
    <input type="hidden" name="status" value="<!--{if $arrForm.status == ""}-->1<!--{else}--><!--{$arrForm.status}--><!--{/if}-->" />
    <input type="hidden" name="search_pageno" value="<!--{$tpl_pageno}-->" />
    <input type="hidden" name="order_id" value="" />

-------------------------------------------------------------------
 変更後
-----------------------------------------------------------------------------------
<form name="form1" id="form1" method="post" action="?" >
    <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
    <input type="hidden" name="mode" value="" />
    <input type="hidden" name="status" value="<!--{if $arrForm.status == ""}-->1<!--{else}--><!--{$arrForm.status|h}--><!--{/if}-->" />
    <input type="hidden" name="search_pageno" value="<!--{$tpl_pageno|h}-->" />
    <input type="hidden" name="order_id" value="" />

=================================================================================================================