From 919b75a138b2431171b3786638dbeef4bba933fc Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Thu, 26 Mar 2026 03:38:19 +0000
Subject: [PATCH] =?UTF-8?q?[KVE-2026-0340]=EA=B7=B8=EB=88=84=EB=B3=B4?=
 =?UTF-8?q?=EB=93=9C=5FSQL=5FInjection=EC=B7=A8=EC=95=BD=EC=A0=90=5F?=
 =?UTF-8?q?=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/member_list.php | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/adm/member_list.php b/adm/member_list.php
index afcf45e77..ec4695b9a 100644
--- a/adm/member_list.php
+++ b/adm/member_list.php
@@ -6,6 +6,12 @@ auth_check_menu($auth, $sub_menu, 'r');
 
 $sql_common = " from {$g5['member_table']} ";
 
+// $sfl 화이트리스트 검증 (KVE-2026-0340)
+$allowed_sfl = array('mb_id', 'mb_nick', 'mb_name', 'mb_level', 'mb_email', 'mb_tel', 'mb_hp', 'mb_point', 'mb_datetime', 'mb_ip', 'mb_recommend');
+if (!in_array($sfl, $allowed_sfl)) {
+    $sfl = 'mb_id';
+}
+
 $sql_search = " where (1) ";
 if ($stx) {
     $sql_search .= " and ( ";