[KVE-2026-0570]그누보드,영카트 SQL Injection 취약점 수정

adm/auth_list.php

@@ -23,6 +23,9 @@ if (!$sst) {
     $sst  = "a.mb_id, au_menu";
     $sod = "";
 }
+$allowed_sst = array('a.mb_id', 'mb_nick', 'au_menu', 'au_auth', 'a.mb_id, au_menu');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'a.mb_id, au_menu';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by $sst $sod ";
 
 $sql = " select count(*) as cnt

adm/board_list.php

@@ -32,6 +32,9 @@ if (!$sst) {
     $sst  = "a.gr_id, a.bo_table";
     $sod = "asc";
 }
+$allowed_sst = array('a.gr_id', 'bo_table', 'bo_skin', 'bo_mobile_skin', 'bo_subject', 'bo_use_sns', 'bo_use_search', 'bo_order', 'a.gr_id, a.bo_table');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'a.gr_id, a.bo_table';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by $sst $sod ";
 
 $sql = " select count(*) as cnt {$sql_common} {$sql_search} {$sql_order} ";

adm/boardgroup_list.php

@@ -34,6 +34,9 @@ if ($stx) {
     $sql_search .= " ) ";
 }
 
+$allowed_sst = array('gr_id', 'gr_subject', 'gr_admin', 'gr_order');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = '';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 if ($sst) {
     $sql_order = " order by {$sst} {$sod} ";
 } else {

adm/boardgroupmember_list.php

@@ -28,6 +28,9 @@ if (!$sst) {
     $sst = "gm_datetime";
     $sod = "desc";
 }
+$allowed_sst = array('gm_datetime', 'b.mb_id', 'b.mb_name', 'b.mb_nick', 'b.mb_today_login', 'a.gm_datetime');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'gm_datetime';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by {$sst} {$sod} ";
 
 $sql = " select count(*) as cnt

adm/point_list.php

@@ -25,6 +25,9 @@ if (!$sst) {
     $sst  = "po_id";
     $sod = "desc";
 }
+$allowed_sst = array('po_id', 'mb_id', 'po_content', 'po_point', 'po_datetime');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'po_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by {$sst} {$sod} ";
 
 $sql = " select count(*) as cnt

adm/poll_list.php

@@ -21,6 +21,9 @@ if (!$sst) {
     $sst = "po_id";
     $sod = "desc";
 }
+$allowed_sst = array('po_id', 'po_subject', 'po_level', 'po_use', 'po_etc');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'po_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by {$sst} {$sod} ";
 
 $sql = " select count(*) as cnt

adm/popular_list.php

@@ -36,6 +36,9 @@ if (!$sst) {
     $sst  = "pp_id";
     $sod = "desc";
 }
+$allowed_sst = array('pp_id', 'pp_word', 'pp_date', 'pp_ip');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'pp_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by {$sst} {$sod} ";
 
 $sql = " select count(*) as cnt

adm/shop_admin/categorylist.php

@@ -42,6 +42,9 @@ if (!$sst)
     $sst  = "ca_id";
     $sod = "asc";
 }
+$allowed_sst = array('ca_id', 'ca_name', 'ca_mb_id', 'ca_use');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'ca_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = "order by $sst $sod";
 
 // 출력할 레코드를 얻음

adm/shop_admin/couponlist.php

@@ -24,6 +24,9 @@ if (!$sst) {
     $sst  = "cp_no";
     $sod = "desc";
 }
+$allowed_sst = array('cp_no', 'cp_id', 'cp_subject', 'mb_id', 'cp_end', 'cp_start', 'cp_method');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'cp_no';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by {$sst} {$sod} ";
 
 $sql = " select count(*) as cnt

adm/shop_admin/itemlist.php

@@ -68,6 +68,9 @@ if (!$sst) {
     $sst  = "it_id";
     $sod = "desc";
 }
+$allowed_sst = array('it_id', 'it_name', 'it_order', 'it_use', 'it_soldout', 'it_hit', 'it_price', 'it_cust_price', 'it_point', 'it_stock_qty');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'it_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = "order by $sst $sod";
 
 

adm/shop_admin/itemtypelist.php

@@ -46,6 +46,9 @@ if (!$sst)  {
     $sst  = "it_id";
     $sod = "desc";
 }
+$allowed_sst = array('it_id', 'it_name', 'it_type1', 'it_type2', 'it_type3', 'it_type4', 'it_type5', 'ca_id');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'it_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = "order by $sst $sod";
 
 $sql_common = "  from {$g5['g5_shop_item_table']} ";