From 516eac386f2d76bba34ee16b118c8af2cc4a4abf Mon Sep 17 00:00:00 2001 From: thisgun Date: Thu, 6 Aug 2026 03:43:10 +0000 Subject: [PATCH] =?UTF-8?q?[KVE-2026-1785]=20=EA=B4=80=EB=A6=AC=EC=9E=90?= =?UTF-8?q?=20=EB=AA=A9=EB=A1=9D=20=EA=B2=80=EC=83=89=ED=95=84=EB=93=9C=20?= =?UTF-8?q?=ED=99=94=EC=9D=B4=ED=8A=B8=EB=A6=AC=EC=8A=A4=ED=8A=B8=20?= =?UTF-8?q?=EB=88=84=EB=9D=BD=20=EB=B3=B4=EC=99=84?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 검색필드가 SQL 컬럼명 위치에 검증 없이 삽입되던 관리자 목록 9개 파일에 허용 컬럼 목록을 추가한다. 허용 컬럼은 각 화면의 검색 UI가 제공하는 항목 기준이며, 미허용 값은 빈 문자열이 아닌 유효 컬럼으로 대체하여 SQL 문법 오류를 방지한다. - adm/auth_list.php - adm/board_list.php - adm/boardgroup_list.php - adm/boardgroupmember_list.php - adm/point_list.php - adm/poll_list.php - adm/popular_list.php - adm/shop_admin/inorderlist.php - adm/shop_admin/personalpaylist.php adm/member_list.php 의 불필요한 주석 제거 Co-Authored-By: Claude Opus 5 (1M context) (cherry picked from commit ff56beff8c6804013e830eb828779e02493cee52) --- adm/auth_list.php | 5 +++++ adm/board_list.php | 5 +++++ adm/boardgroup_list.php | 5 +++++ adm/boardgroupmember_list.php | 5 +++++ adm/member_list.php | 1 - adm/point_list.php | 5 +++++ adm/poll_list.php | 5 +++++ adm/popular_list.php | 5 +++++ adm/shop_admin/inorderlist.php | 5 +++++ adm/shop_admin/personalpaylist.php | 5 +++++ 10 files changed, 45 insertions(+), 1 deletion(-) diff --git a/adm/auth_list.php b/adm/auth_list.php index 998c3fba9..70216f37d 100644 --- a/adm/auth_list.php +++ b/adm/auth_list.php @@ -8,6 +8,11 @@ if ($is_admin != 'super') { $sql_common = " from {$g5['auth_table']} a left join {$g5['member_table']} b on (a.mb_id=b.mb_id) "; +$allowed_sfl = array('a.mb_id'); +if (!in_array($sfl, $allowed_sfl)) { + $sfl = 'a.mb_id'; +} + $sql_search = " where (1) "; if ($stx) { $sql_search .= " and ( "; diff --git a/adm/board_list.php b/adm/board_list.php index f63fd0fb8..faeb8bea1 100644 --- a/adm/board_list.php +++ b/adm/board_list.php @@ -12,6 +12,11 @@ if ($is_admin != "super") { $sql_search .= " and (a.gr_id = b.gr_id and b.gr_admin = '{$member['mb_id']}') "; } +$allowed_sfl = array('bo_table', 'bo_subject', 'a.gr_id'); +if (!in_array($sfl, $allowed_sfl)) { + $sfl = 'bo_table'; +} + if ($stx) { $sql_search .= " and ( "; switch ($sfl) { diff --git a/adm/boardgroup_list.php b/adm/boardgroup_list.php index a9c28f5bd..a05b6d976 100644 --- a/adm/boardgroup_list.php +++ b/adm/boardgroup_list.php @@ -20,6 +20,11 @@ if ($is_admin != 'super') { $sql_search .= " and (gr_admin = '{$member['mb_id']}') "; } +$allowed_sfl = array('gr_subject', 'gr_id', 'gr_admin'); +if (!in_array($sfl, $allowed_sfl)) { + $sfl = 'gr_subject'; +} + if ($stx) { $sql_search .= " and ( "; switch ($sfl) { diff --git a/adm/boardgroupmember_list.php b/adm/boardgroupmember_list.php index aa8433af2..c64be9379 100644 --- a/adm/boardgroupmember_list.php +++ b/adm/boardgroupmember_list.php @@ -13,6 +13,11 @@ $sql_common = " from {$g5['group_member_table']} a left outer join {$g5['member_table']} b on (a.mb_id = b.mb_id) "; $sql_search = " where gr_id = '{$gr_id}' "; +$allowed_sfl = array('a.mb_id'); +if (!in_array($sfl, $allowed_sfl)) { + $sfl = 'a.mb_id'; +} + // 회원아이디로 검색되지 않던 오류를 수정 if (isset($stx) && $stx) { $sql_search .= " and ( "; diff --git a/adm/member_list.php b/adm/member_list.php index 778ad1497..e3bdc5003 100644 --- a/adm/member_list.php +++ b/adm/member_list.php @@ -6,7 +6,6 @@ auth_check_menu($auth, $sub_menu, 'r'); $sql_common = " from {$g5['member_table']} "; -// $sfl 화이트리스트 검증 (KVE-2026-0340) $allowed_sfl = array('mb_id', 'mb_nick', 'mb_name', 'mb_level', 'mb_email', 'mb_tel', 'mb_hp', 'mb_point', 'mb_datetime', 'mb_ip', 'mb_recommend'); if (!in_array($sfl, $allowed_sfl)) { $sfl = 'mb_id'; diff --git a/adm/point_list.php b/adm/point_list.php index 0e2d02198..942189dd8 100644 --- a/adm/point_list.php +++ b/adm/point_list.php @@ -6,6 +6,11 @@ auth_check_menu($auth, $sub_menu, 'r'); $sql_common = " from {$g5['point_table']} po"; +$allowed_sfl = array('mb_id', 'po_content'); +if (!in_array($sfl, $allowed_sfl)) { + $sfl = 'mb_id'; +} + $sql_search = " where (1) "; if ($stx) { diff --git a/adm/poll_list.php b/adm/poll_list.php index 09d58f98d..e957605cf 100644 --- a/adm/poll_list.php +++ b/adm/poll_list.php @@ -6,6 +6,11 @@ auth_check_menu($auth, $sub_menu, 'r'); $sql_common = " from {$g5['poll_table']} "; +$allowed_sfl = array('po_subject'); +if (!in_array($sfl, $allowed_sfl)) { + $sfl = 'po_subject'; +} + $sql_search = " where (1) "; if ($stx) { $sql_search .= " and ( "; diff --git a/adm/popular_list.php b/adm/popular_list.php index e2d16888b..e0cfccfe2 100644 --- a/adm/popular_list.php +++ b/adm/popular_list.php @@ -16,6 +16,11 @@ if (isset($_POST['chk']) && is_array($_POST['chk'])) { } $sql_common = " from {$g5['popular_table']} a "; +$allowed_sfl = array('pp_word', 'pp_date'); +if (!in_array($sfl, $allowed_sfl)) { + $sfl = 'pp_word'; +} + $sql_search = " where (1) "; if ($stx) { diff --git a/adm/shop_admin/inorderlist.php b/adm/shop_admin/inorderlist.php index c23730e02..c55586a1d 100644 --- a/adm/shop_admin/inorderlist.php +++ b/adm/shop_admin/inorderlist.php @@ -6,6 +6,11 @@ auth_check_menu($auth, $sub_menu, "r"); $sql_common = " from {$g5['g5_shop_order_data_table']} "; +$allowed_sfl = array('od_id'); +if (!in_array($sfl, $allowed_sfl)) { + $sfl = 'od_id'; +} + $sql_search = " where cart_id <> '0' "; if ($stx) { $sql_search .= " and ( "; diff --git a/adm/shop_admin/personalpaylist.php b/adm/shop_admin/personalpaylist.php index dfa0738ac..e1cee42e7 100644 --- a/adm/shop_admin/personalpaylist.php +++ b/adm/shop_admin/personalpaylist.php @@ -6,6 +6,11 @@ auth_check_menu($auth, $sub_menu, "r"); $sql_common = " from {$g5['g5_shop_personalpay_table']} "; +$allowed_sfl = array('pp_id', 'pp_name', 'od_id'); +if (!in_array($sfl, $allowed_sfl)) { + $sfl = 'pp_id'; +} + $sql_search = " where (1) "; if ($stx) { $sql_search .= " and ( ";