EC-CUBE 'LC_Page_Mypage_DeliveryAddr.php' Path Disclosure Vulnerability

Bugtraq ID:	63825
Class:	Design Error
CVE:	CVE-2013-5994
Remote:	Yes
Local:	No
Published:	Nov 19 2013 12:00AM
Updated:	Nov 19 2013 12:00AM
Credit:	Gen Sato
Vulnerable:	EC-CUBE EC-CUBE 2.13 EC-CUBE EC-CUBE 2.12.6 EC-CUBE EC-CUBE 2.12.5 EC-CUBE EC-CUBE 2.12.4 EC-CUBE EC-CUBE 2.12.3 EC-CUBE EC-CUBE 2.12.2 EC-CUBE EC-CUBE 2.12.1 EC-CUBE EC-CUBE 2.12 EC-CUBE EC-CUBE 2.11.5 EC-CUBE EC-CUBE 2.11.3 EC-CUBE EC-CUBE 2.11.2 EC-CUBE EC-CUBE 2.11.1 EC-CUBE EC-CUBE 2.11 EC-CUBE EC-CUBE 2.4.2 EC-CUBE EC-CUBE 2.4.1 EC-CUBE EC-CUBE 2.3 EC-CUBE EC-CUBE 2.3.0-rc1 EC-CUBE EC-CUBE 2.2.0-beta EC-CUBE EC-CUBE 2.12.6en EC-CUBE EC-CUBE 2.12.5en EC-CUBE EC-CUBE 2.12.4en EC-CUBE EC-CUBE 2.12.3enP2 EC-CUBE EC-CUBE 2.12.3enP1 EC-CUBE EC-CUBE 2.12.3en EC-CUBE EC-CUBE 2.11.4
Not Vulnerable:	EC-CUBE EC-CUBE 2.13.1

EC-CUBE 'LC_Page_Mypage_DeliveryAddr.php' Path Disclosure Vulnerability

EC-CUBE is prone to a path-disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to obtain sensitive information that may lead to further attacks.

Versions prior to EC-CUBE 2.13.1 are vulnerable.

EC-CUBE 'LC_Page_Mypage_DeliveryAddr.php' Path Disclosure Vulnerability

An attacker can exploit this issue using a web browser.

EC-CUBE 'LC_Page_Mypage_DeliveryAddr.php' Path Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

EC-CUBE 'LC_Page_Mypage_DeliveryAddr.php' Path Disclosure Vulnerability

References:

• EC-CUBE Homepage (LOCKON CO. LTD.)
  
• Vulnerability of the file path information leakage (LOCKON CO. LTD.)
  
• JVN#06870202 EC-CUBE information disclosure vulnerability (JPCERT/CC and IPA)
  
• JVNDB-2013-000098 EC-CUBE information disclosure vulnerability (IPA)