From 8be4476f56ea333fe1c1eb23fb98ff869bf450d1 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Tue, 26 May 2026 03:50:52 +0000
Subject: [PATCH] =?UTF-8?q?[KVE-2026-0869]=20=EC=9D=B8=EC=8A=A4=ED=86=A8?=
 =?UTF-8?q?=EB=9F=AC=20=EA=B4=80=EB=A6=AC=EC=9E=90=20=EC=9E=85=EB=A0=A5?=
 =?UTF-8?q?=EA=B0=92=20SQL=20Injection=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 install/install_db.php | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/install/install_db.php b/install/install_db.php
index af1399f95..3ef1098be 100644
--- a/install/install_db.php
+++ b/install/install_db.php
@@ -44,6 +44,12 @@ if (preg_match("/[^0-9a-z_]+/i", $admin_id)) {
     die('<div class="ins_inner"><p>관리자 아이디는 영문자, 숫자, _ 만 입력하세요.</p><div class="inner_btn"><a href="./install_config.php">뒤로가기</a></div></div>');
 }
 
+// 관리자 이메일 형식 검증
+$admin_email = trim($admin_email);
+if (!$admin_email || !filter_var($admin_email, FILTER_VALIDATE_EMAIL)) {
+    die('<div class="ins_inner"><p>올바른 관리자 E-mail 주소를 입력하세요.</p><div class="inner_btn"><a href="./install_config.php">뒤로가기</a></div></div>');
+}
+
 $g5_install = isset($_POST['g5_install']) ? (int) $_POST['g5_install'] : 0;
 $g5_shop_prefix = isset($_POST['g5_shop_prefix']) ? safe_install_string_check($_POST['g5_shop_prefix']) : 'yc5_';
 $g5_shop_install = isset($_POST['g5_shop_install']) ? (int) $_POST['g5_shop_install'] : 0;
@@ -83,6 +89,10 @@ if (!$select_db) {
 
 $mysql_set_mode = 'false';
 sql_set_charset(G5_DB_CHARSET, $dblink);
+
+// 관리자 입력값 SQL escape — sql_set_charset 이후 적용
+$admin_name = sql_real_escape_string(trim($admin_name), $dblink);
+$admin_email = sql_real_escape_string($admin_email, $dblink);
 $result = sql_query(" SELECT @@sql_mode as mode ", true, $dblink);
 $row = sql_fetch_array($result);
 if($row['mode']) {