From 2dff49914bdcf54d54f0e76aa9dfb9d195b35ba1 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Thu, 16 Apr 2026 03:35:29 +0000
Subject: [PATCH] =?UTF-8?q?[security]KVE-2026-0710=20=EA=B7=B8=EB=88=84?=
 =?UTF-8?q?=EB=B3=B4=EB=93=9C5=20SQL=20Injection=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/member_form_update.php   | 8 ++++----
 bbs/email_stop.php           | 2 +-
 bbs/memo_form.php            | 4 ++--
 bbs/register_email.php       | 4 ++--
 bbs/write_comment_update.php | 2 +-
 5 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/adm/member_form_update.php b/adm/member_form_update.php
index 1bf338e68..bcc7dc0ac 100644
--- a/adm/member_form_update.php
+++ b/adm/member_form_update.php
@@ -19,8 +19,8 @@ $mb_certify     = isset($_POST['mb_certify']) ? preg_replace('/[^0-9a-z_]/i', ''
 $mb_zip         = isset($_POST['mb_zip']) ? preg_replace('/[^0-9a-z_]/i', '', $_POST['mb_zip']) : '';
 
 // 광고성 정보 수신
-$mb_marketing_agree         = isset($_POST['mb_marketing_agree']) ? clean_xss_tags($_POST['mb_marketing_agree'], 1, 1) : '0';
-$mb_thirdparty_agree         = isset($_POST['mb_thirdparty_agree']) ? clean_xss_tags($_POST['mb_thirdparty_agree'], 1, 1) : '0';
+$mb_marketing_agree         = isset($_POST['mb_marketing_agree']) ? addslashes(clean_xss_tags(stripslashes($_POST['mb_marketing_agree']), 1, 1)) : '0';
+$mb_thirdparty_agree         = isset($_POST['mb_thirdparty_agree']) ? addslashes(clean_xss_tags(stripslashes($_POST['mb_thirdparty_agree']), 1, 1)) : '0';
 
 // 관리자가 자동등록방지를 사용해야 할 경우 ( 회원의 비밀번호 변경시 캡챠를 체크한다 )
 if ($mb_password) {
@@ -84,9 +84,9 @@ for ($i = 1; $i <= 10; $i++) {
 
 foreach ($check_keys as $key) {
     if( in_array($key, array('mb_signature', 'mb_profile')) ){
-        $posts[$key] = isset($_POST[$key]) ? clean_xss_tags($_POST[$key], 1, 1, 0, 0) : '';
+        $posts[$key] = isset($_POST[$key]) ? addslashes(clean_xss_tags(stripslashes($_POST[$key]), 1, 1, 0, 0)) : '';
     } else {
-        $posts[$key] = isset($_POST[$key]) ? clean_xss_tags($_POST[$key], 1, 1) : '';
+        $posts[$key] = isset($_POST[$key]) ? addslashes(clean_xss_tags(stripslashes($_POST[$key]), 1, 1)) : '';
     }
 }
 
diff --git a/bbs/email_stop.php b/bbs/email_stop.php
index 0a17ec707..997707a58 100644
--- a/bbs/email_stop.php
+++ b/bbs/email_stop.php
@@ -1,7 +1,7 @@
 <?php
 include_once('./_common.php');
 
-$mb_id = isset($_REQUEST['mb_id']) ? clean_xss_tags($_REQUEST['mb_id'], 1, 1) : '';
+$mb_id = isset($_REQUEST['mb_id']) ? addslashes(clean_xss_tags(stripslashes($_REQUEST['mb_id']), 1, 1)) : '';
 
 $sql = " select mb_id, mb_email, mb_datetime from {$g5['member_table']} where mb_id = '{$mb_id}' ";
 $row = sql_fetch($sql);
diff --git a/bbs/memo_form.php b/bbs/memo_form.php
index 55ea41a36..b4f422c0c 100644
--- a/bbs/memo_form.php
+++ b/bbs/memo_form.php
@@ -13,8 +13,8 @@ if (!$member['mb_open'] && $is_admin != 'super' && $member['mb_id'] != $mb_id) {
 }
 
 $content = "";
-$me_recv_mb_id   = isset($_REQUEST['me_recv_mb_id']) ? clean_xss_tags($_REQUEST['me_recv_mb_id'], 1, 1) : '';
-$me_id           = isset($_REQUEST['me_id']) ? clean_xss_tags($_REQUEST['me_id'], 1, 1) : '';
+$me_recv_mb_id   = isset($_REQUEST['me_recv_mb_id']) ? addslashes(clean_xss_tags(stripslashes($_REQUEST['me_recv_mb_id']), 1, 1)) : '';
+$me_id           = isset($_REQUEST['me_id']) ? addslashes(clean_xss_tags(stripslashes($_REQUEST['me_id']), 1, 1)) : '';
 
 // 탈퇴한 회원에게 쪽지 보낼 수 없음
 if ($me_recv_mb_id)
diff --git a/bbs/register_email.php b/bbs/register_email.php
index 4dbf8d57a..d9779c6bb 100644
--- a/bbs/register_email.php
+++ b/bbs/register_email.php
@@ -5,7 +5,7 @@ include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
 $g5['title'] = '메일인증 메일주소 변경';
 include_once('./_head.php');
 
-$mb_id = isset($_GET['mb_id']) ? substr(clean_xss_tags($_GET['mb_id']), 0, 20) : '';
+$mb_id = isset($_GET['mb_id']) ? substr(addslashes(clean_xss_tags(stripslashes($_GET['mb_id']), 1, 1)), 0, 20) : '';
 $sql = " select mb_email, mb_datetime, mb_ip, mb_email_certify, mb_id from {$g5['member_table']} where mb_id = '{$mb_id}' ";
 $mb = sql_fetch($sql);
 
@@ -18,7 +18,7 @@ if (substr($mb['mb_email_certify'],0,1)!=0) {
 }
 
 $ckey = isset($_GET['ckey']) ? trim($_GET['ckey']) : '';
-$key  = function_exists('get_email_cert_key') ? get_email_cert_key($mb_id, $mb['mb_datetime']) : md5($mb['mb_ip'].$mb['mb_datetime']);
+$key  = get_email_cert_key($mb_id, $mb['mb_datetime']);
 
 if(!$ckey || $ckey !== $key)
     alert('올바른 방법으로 이용해 주십시오.', G5_URL);
diff --git a/bbs/write_comment_update.php b/bbs/write_comment_update.php
index db2a62a0b..a46f0b4c4 100644
--- a/bbs/write_comment_update.php
+++ b/bbs/write_comment_update.php
@@ -18,7 +18,7 @@ if (substr_count($wr_content, "&#") > 50) {
 $w = isset($_POST['w']) ? clean_xss_tags($_POST['w']) : '';
 $wr_name  = isset($_POST['wr_name']) ? addslashes(clean_xss_tags(stripslashes(trim($_POST['wr_name'])))) : '';
 $wr_name  = preg_replace("#[\\\]+$#", "", $wr_name);
-$wr_secret = isset($_POST['wr_secret']) ? clean_xss_tags($_POST['wr_secret']) : '';
+$wr_secret = isset($_POST['wr_secret']) ? addslashes(clean_xss_tags(stripslashes($_POST['wr_secret']))) : '';
 $wr_email = $wr_subject = '';
 $reply_array = array();