gper/Gnuboard5
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[KVE-2026-0553]그누보드 SQL Injection 취약점 수정

Browse Source
This commit is contained in:
thisgun committed 2026-03-30 09:50:38 +00:00
1 parent 919b75a138
commit 60d37b853b
1 file changed
+10 -7
Download Patch File Download Diff File Expand all files Collapse all files
bbs/write_update.php
+10 -7
View File
@@ -241,12 +241,13 @@ if ($w == '' || $w == 'r') {
} else {
$mb_id = '';
// 비회원의 경우 이름이 누락되는 경우가 있음
$wr_name = clean_xss_tags(trim($_POST['wr_name']));
$wr_name = addslashes(clean_xss_tags(stripslashes(trim($_POST['wr_name']))));
$wr_name = preg_replace("#[\\\]+$#", "", $wr_name);
if (!$wr_name)
alert('이름은 필히 입력하셔야 합니다.');
$wr_password = get_encrypt_string($wr_password);
$wr_email = get_email_address(trim($_POST['wr_email']));
$wr_homepage = clean_xss_tags($wr_homepage);
$wr_homepage = addslashes(clean_xss_tags(stripslashes($wr_homepage)));
}
if ($w == 'r') {
@@ -362,16 +363,17 @@ if ($w == '' || $w == 'r') {
$wr_homepage = addslashes(clean_xss_tags($member['mb_homepage']));
} else {
$mb_id = $wr['mb_id'];
if(isset($_POST['wr_name']) && $_POST['wr_name'])
$wr_name = clean_xss_tags(trim($_POST['wr_name']));
else
if(isset($_POST['wr_name']) && $_POST['wr_name']) {
$wr_name = addslashes(clean_xss_tags(stripslashes(trim($_POST['wr_name']))));
$wr_name = preg_replace("#[\\\]+$#", "", $wr_name);
} else
$wr_name = addslashes(clean_xss_tags($wr['wr_name']));
if(isset($_POST['wr_email']) && $_POST['wr_email'])
$wr_email = get_email_address(trim($_POST['wr_email']));
else
$wr_email = addslashes($wr['wr_email']);
if(isset($_POST['wr_homepage']) && $_POST['wr_homepage'])
$wr_homepage = addslashes(clean_xss_tags($_POST['wr_homepage']));
$wr_homepage = addslashes(clean_xss_tags(stripslashes($_POST['wr_homepage'])));
else
$wr_homepage = addslashes(clean_xss_tags($wr['wr_homepage']));
}
@@ -379,7 +381,8 @@ if ($w == '' || $w == 'r') {
$mb_id = "";
// 비회원의 경우 이름이 누락되는 경우가 있음
if (!trim($wr_name)) alert("이름은 필히 입력하셔야 합니다.");
$wr_name = clean_xss_tags(trim($_POST['wr_name']));
$wr_name = addslashes(clean_xss_tags(stripslashes(trim($_POST['wr_name']))));
$wr_name = preg_replace("#[\\\]+$#", "", $wr_name);
$wr_email = get_email_address(trim($_POST['wr_email']));
}