diff --git a/adm/board_form_update.php b/adm/board_form_update.php
index 713661932..c4a9223bf 100644
--- a/adm/board_form_update.php
+++ b/adm/board_form_update.php
@@ -176,7 +176,17 @@ $bo_write_min = isset($_POST['bo_write_min']) ? (int) $_POST['bo_write_min'] : 0
 $bo_write_max = isset($_POST['bo_write_max']) ? (int) $_POST['bo_write_max'] : 0;
 $bo_comment_min = isset($_POST['bo_comment_min']) ? (int) $_POST['bo_comment_min'] : 0;
 $bo_comment_max = isset($_POST['bo_comment_max']) ? (int) $_POST['bo_comment_max'] : 0;
-$bo_sort_field = isset($_POST['bo_sort_field']) ? addslashes(clean_xss_tags(stripslashes($_POST['bo_sort_field']), 1, 1)) : '';
+$bo_sort_field = isset($_POST['bo_sort_field']) ? trim(stripslashes($_POST['bo_sort_field'])) : '';
+$bo_allowed_sort_field = array('');
+if (function_exists('get_board_sort_fields')) {
+    foreach (get_board_sort_fields(isset($board) ? $board : array()) as $bo_sort_v) {
+        $bo_allowed_sort_field[] = $bo_sort_v[0];
+    }
+}
+if (!in_array($bo_sort_field, $bo_allowed_sort_field, true)) {
+    $bo_sort_field = '';
+}
+$bo_sort_field = addslashes($bo_sort_field);
 
 if (strpbrk($bo_skin.$bo_mobile_skin, "?%*:|\"<>") !== false) {
     alert('스킨 디렉토리명 오류!');
diff --git a/bbs/list.php b/bbs/list.php
index b35e28843..8e66fa756 100644
--- a/bbs/list.php
+++ b/bbs/list.php
@@ -170,7 +170,13 @@ $td_width = (int)(100 / $bo_gallery_cols);
 // 인덱스 필드가 아니면 정렬에 사용하지 않음
 //if (!$sst || ($sst && !(strstr($sst, 'wr_id') || strstr($sst, "wr_datetime")))) {
 if (!$sst) {
-    if ($board['bo_sort_field']) {
+    $bo_allowed_sort_field = array();
+    if (function_exists('get_board_sort_fields')) {
+        foreach (get_board_sort_fields($board) as $bo_sort_v) {
+            $bo_allowed_sort_field[] = $bo_sort_v[0];
+        }
+    }
+    if ($board['bo_sort_field'] && in_array($board['bo_sort_field'], $bo_allowed_sort_field, true)) {
         $sst = $board['bo_sort_field'];
     } else {
         $sst  = "wr_num, wr_reply";