From 604cef808e148f1fc76cc5be780a9f88d574a930 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Tue, 31 Mar 2026 01:21:11 +0000
Subject: [PATCH] =?UTF-8?q?[=EB=B3=B4=EC=95=88=ED=8C=A8=EC=B9=98]=EA=B7=B8?=
 =?UTF-8?q?=EB=88=84=EB=B3=B4=EB=93=9C=20=EC=98=81=EC=B9=B4=ED=8A=B8=20SQL?=
 =?UTF-8?q?=5Finjection=20=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/shop_admin/couponlist.php  | 2 ++
 adm/shop_admin/itemqalist.php  | 3 +++
 adm/shop_admin/itemuselist.php | 3 +++
 shop/list.php                  | 3 +++
 4 files changed, 11 insertions(+)

diff --git a/adm/shop_admin/couponlist.php b/adm/shop_admin/couponlist.php
index 71d230bbf..dcc39f021 100644
--- a/adm/shop_admin/couponlist.php
+++ b/adm/shop_admin/couponlist.php
@@ -6,6 +6,8 @@ auth_check_menu($auth, $sub_menu, "r");
 
 $sql_common = " from {$g5['g5_shop_coupon_table']} ";
 
+if ($sfl && !in_array($sfl, array('mb_id', 'cp_subject', 'cp_id'))) $sfl = '';
+
 $sql_search = " where (1) ";
 if ($stx) {
     $sql_search .= " and ( ";
diff --git a/adm/shop_admin/itemqalist.php b/adm/shop_admin/itemqalist.php
index 2230bf5c3..c9cade868 100644
--- a/adm/shop_admin/itemqalist.php
+++ b/adm/shop_admin/itemqalist.php
@@ -31,6 +31,9 @@ if (!$sst) {
     $sst = "iq_id";
     $sod = "desc";
 }
+$allowed_sst = array('iq_id', 'a.it_id', 'it_name', 'iq_time');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'iq_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 
 $sql_common = "  from {$g5['g5_shop_item_qa_table']} a
                  left join {$g5['g5_shop_item_table']} b on (a.it_id = b.it_id)
diff --git a/adm/shop_admin/itemuselist.php b/adm/shop_admin/itemuselist.php
index aa4ffadf9..9423e5938 100644
--- a/adm/shop_admin/itemuselist.php
+++ b/adm/shop_admin/itemuselist.php
@@ -33,6 +33,9 @@ if (!$sst) {
     $sst = "is_id";
     $sod = "desc";
 }
+$allowed_sst = array('is_id', 'a.it_id', 'it_name', 'is_name', 'is_score', 'is_time');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'is_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 
 $sql_common = "  from {$g5['g5_shop_item_use_table']} a
                  left join {$g5['g5_shop_item_table']} b on (a.it_id = b.it_id)
diff --git a/shop/list.php b/shop/list.php
index 5a5da824c..889d422c0 100644
--- a/shop/list.php
+++ b/shop/list.php
@@ -8,6 +8,9 @@ $skin = isset($_REQUEST['skin']) ? safe_replace_regex($_REQUEST['skin'], 'skin')
 if( isset($sort) && ! in_array($sort, array('it_name', 'it_sum_qty', 'it_price', 'it_use_avg', 'it_use_cnt', 'it_update_time')) ){
     $sort='';
 }
+if( !isset($sortodr) || !in_array(strtolower($sortodr), array('asc', 'desc')) ){
+    $sortodr='';
+}
 
 if (G5_IS_MOBILE) {
     include_once(G5_MSHOP_PATH.'/list.php');