HOME >> IT Security >> Vulnerabilities >> Security Alert for Vulnerability in EC-CUBE
Security Alert for Vulnerability in EC-CUBE
Published: Oct 14, 2011
>> JAPANESE
Information-technology Promotion Agency, Japan (IPA, Chairman Kazumasa Fujie) has issued a security alert concerning security vulnerability in EC-CUBE on October 14, 2011. To fix this vulnerability, update the software to the fixed version provided by the product developer.
1.Overview
EC-CUBE from LOCKON CO. LTD. is an open source software for creating online shopping websites. EC-CUBE is vulnerable to SQL Injection due to a flaw in the database processing. If exploited, the vulnerability could allow an attacker to obtain personal information stored in the EC-CUBE database.
Get the fixed version at the following URL and update the software.
http://www.ec-cube.net/download/index.php (Japanese)
For the latest information, refer to the following URL:
http://jvndb.jvn.jp/jvndb/JVNDB-2011-000087
In line with the Information Security Early Warning Partnership, the IPA received a report concerning this vulnerability through the creditee below, and the JPCERT Coordination Center (JPCERT/CC) made adjustments to clarify the matter with the product developer and made it public on October 14, 2011.
| Credit: | Nobuhisa Tsukada | Seasoft (Reported: September 2, 2011) |
2.Impact
An attacker could manipulate the EC-CUBE database and obtain personal information.
3.Solution
To fix this vulnerability, update the software to the fixed version provided by the product developer.
4.CVSS Severity
(1)Evaluation Result
| Severity Rating (CVSS base score) |
□ Low (0.0~3.9) |
■Medium (4.0~6.9) |
□ High (7.0~10.0) |
|---|---|---|---|
| CVSS base score | 5.0 |
(2) Base Score Metrics
| AV:Access Vector | □ Local | □ Adjacent Network |
■ Network |
|---|---|---|---|
| AC:Access Complexity | □ High | □ Medium | ■ Low |
| Au:Authentication | □ Multiple | □ Single | ■ None |
| C:Confidentiality Impact | □ None | ■ Partial | □ Complete |
| I:Integrity Impact | ■ None | □ Partial | □ Complete |
| A:Availability Impact | ■ None | □ Partial | □ Complete |
■:Selected Values
5.CWE Type
This vulnerability has been CWE classified as “SQL Injection (CWE-89)”.
Contact
IT Security Center,
Information-technology Promotion Agency, Japan (ISEC/IPA)
E-mail: 