From 82574fd4a8940bd61b10dc88375cff0a3a2eabd9 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Mon, 30 Mar 2026 12:01:44 +0000
Subject: [PATCH] =?UTF-8?q?[KVE-2026-0570]=EA=B7=B8=EB=88=84=EB=B3=B4?=
 =?UTF-8?q?=EB=93=9C,=EC=98=81=EC=B9=B4=ED=8A=B8=20SQL=20Injection=20?=
 =?UTF-8?q?=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/auth_list.php               | 3 +++
 adm/board_list.php              | 3 +++
 adm/boardgroup_list.php         | 3 +++
 adm/boardgroupmember_list.php   | 3 +++
 adm/point_list.php              | 3 +++
 adm/poll_list.php               | 3 +++
 adm/popular_list.php            | 3 +++
 adm/shop_admin/categorylist.php | 3 +++
 adm/shop_admin/couponlist.php   | 3 +++
 adm/shop_admin/itemlist.php     | 3 +++
 adm/shop_admin/itemtypelist.php | 3 +++
 11 files changed, 33 insertions(+)

diff --git a/adm/auth_list.php b/adm/auth_list.php
index 08b10bd4b..dff43a403 100644
--- a/adm/auth_list.php
+++ b/adm/auth_list.php
@@ -23,6 +23,9 @@ if (!$sst) {
     $sst  = "a.mb_id, au_menu";
     $sod = "";
 }
+$allowed_sst = array('a.mb_id', 'mb_nick', 'au_menu', 'au_auth', 'a.mb_id, au_menu');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'a.mb_id, au_menu';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by $sst $sod ";
 
 $sql = " select count(*) as cnt
diff --git a/adm/board_list.php b/adm/board_list.php
index 0418bec5b..f63fd0fb8 100644
--- a/adm/board_list.php
+++ b/adm/board_list.php
@@ -32,6 +32,9 @@ if (!$sst) {
     $sst  = "a.gr_id, a.bo_table";
     $sod = "asc";
 }
+$allowed_sst = array('a.gr_id', 'bo_table', 'bo_skin', 'bo_mobile_skin', 'bo_subject', 'bo_use_sns', 'bo_use_search', 'bo_order', 'a.gr_id, a.bo_table');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'a.gr_id, a.bo_table';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by $sst $sod ";
 
 $sql = " select count(*) as cnt {$sql_common} {$sql_search} {$sql_order} ";
diff --git a/adm/boardgroup_list.php b/adm/boardgroup_list.php
index f52394ffa..a9c28f5bd 100644
--- a/adm/boardgroup_list.php
+++ b/adm/boardgroup_list.php
@@ -34,6 +34,9 @@ if ($stx) {
     $sql_search .= " ) ";
 }
 
+$allowed_sst = array('gr_id', 'gr_subject', 'gr_admin', 'gr_order');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = '';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 if ($sst) {
     $sql_order = " order by {$sst} {$sod} ";
 } else {
diff --git a/adm/boardgroupmember_list.php b/adm/boardgroupmember_list.php
index 9b9fbae52..aa8433af2 100644
--- a/adm/boardgroupmember_list.php
+++ b/adm/boardgroupmember_list.php
@@ -28,6 +28,9 @@ if (!$sst) {
     $sst = "gm_datetime";
     $sod = "desc";
 }
+$allowed_sst = array('gm_datetime', 'b.mb_id', 'b.mb_name', 'b.mb_nick', 'b.mb_today_login', 'a.gm_datetime');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'gm_datetime';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by {$sst} {$sod} ";
 
 $sql = " select count(*) as cnt
diff --git a/adm/point_list.php b/adm/point_list.php
index b368791a5..fe98082e4 100644
--- a/adm/point_list.php
+++ b/adm/point_list.php
@@ -25,6 +25,9 @@ if (!$sst) {
     $sst  = "po_id";
     $sod = "desc";
 }
+$allowed_sst = array('po_id', 'mb_id', 'po_content', 'po_point', 'po_datetime');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'po_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by {$sst} {$sod} ";
 
 $sql = " select count(*) as cnt
diff --git a/adm/poll_list.php b/adm/poll_list.php
index b277c2db6..09d58f98d 100644
--- a/adm/poll_list.php
+++ b/adm/poll_list.php
@@ -21,6 +21,9 @@ if (!$sst) {
     $sst = "po_id";
     $sod = "desc";
 }
+$allowed_sst = array('po_id', 'po_subject', 'po_level', 'po_use', 'po_etc');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'po_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by {$sst} {$sod} ";
 
 $sql = " select count(*) as cnt
diff --git a/adm/popular_list.php b/adm/popular_list.php
index f50350901..da83d1caa 100644
--- a/adm/popular_list.php
+++ b/adm/popular_list.php
@@ -36,6 +36,9 @@ if (!$sst) {
     $sst  = "pp_id";
     $sod = "desc";
 }
+$allowed_sst = array('pp_id', 'pp_word', 'pp_date', 'pp_ip');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'pp_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by {$sst} {$sod} ";
 
 $sql = " select count(*) as cnt
diff --git a/adm/shop_admin/categorylist.php b/adm/shop_admin/categorylist.php
index 201245d71..f2e30d8c3 100644
--- a/adm/shop_admin/categorylist.php
+++ b/adm/shop_admin/categorylist.php
@@ -42,6 +42,9 @@ if (!$sst)
     $sst  = "ca_id";
     $sod = "asc";
 }
+$allowed_sst = array('ca_id', 'ca_name', 'ca_mb_id', 'ca_use');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'ca_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = "order by $sst $sod";
 
 // 출력할 레코드를 얻음
diff --git a/adm/shop_admin/couponlist.php b/adm/shop_admin/couponlist.php
index e50153ef6..71d230bbf 100644
--- a/adm/shop_admin/couponlist.php
+++ b/adm/shop_admin/couponlist.php
@@ -24,6 +24,9 @@ if (!$sst) {
     $sst  = "cp_no";
     $sod = "desc";
 }
+$allowed_sst = array('cp_no', 'cp_id', 'cp_subject', 'mb_id', 'cp_end', 'cp_start', 'cp_method');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'cp_no';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = " order by {$sst} {$sod} ";
 
 $sql = " select count(*) as cnt
diff --git a/adm/shop_admin/itemlist.php b/adm/shop_admin/itemlist.php
index a0c2e38bc..fb40590ed 100644
--- a/adm/shop_admin/itemlist.php
+++ b/adm/shop_admin/itemlist.php
@@ -68,6 +68,9 @@ if (!$sst) {
     $sst  = "it_id";
     $sod = "desc";
 }
+$allowed_sst = array('it_id', 'it_name', 'it_order', 'it_use', 'it_soldout', 'it_hit', 'it_price', 'it_cust_price', 'it_point', 'it_stock_qty');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'it_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = "order by $sst $sod";
 
 
diff --git a/adm/shop_admin/itemtypelist.php b/adm/shop_admin/itemtypelist.php
index 0587363fb..56f098d42 100644
--- a/adm/shop_admin/itemtypelist.php
+++ b/adm/shop_admin/itemtypelist.php
@@ -46,6 +46,9 @@ if (!$sst)  {
     $sst  = "it_id";
     $sod = "desc";
 }
+$allowed_sst = array('it_id', 'it_name', 'it_type1', 'it_type2', 'it_type3', 'it_type4', 'it_type5', 'ca_id');
+if ($sst && !in_array($sst, $allowed_sst)) $sst = 'it_id';
+if ($sod && !in_array(strtolower($sod), array('asc', 'desc'))) $sod = '';
 $sql_order = "order by $sst $sod";
 
 $sql_common = "  from {$g5['g5_shop_item_table']} ";