From a781b4aef39e297c4f86ce3ab70b4f8d756ddb7c Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Tue, 26 May 2026 06:27:53 +0000
Subject: [PATCH] =?UTF-8?q?[KVE-2026-0876]=20=EB=AA=A8=EB=B0=94=EC=9D=BC?=
 =?UTF-8?q?=20=EC=83=81=ED=92=88=20=EB=A6=AC=EC=8A=A4=ED=8A=B8=20sort=20?=
 =?UTF-8?q?=ED=8C=8C=EB=9D=BC=EB=AF=B8=ED=84=B0=20Blind=20SQL=20Injection?=
 =?UTF-8?q?=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 mobile/shop/_common.php  | 3 ++-
 mobile/shop/listtype.php | 3 +++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/mobile/shop/_common.php b/mobile/shop/_common.php
index 0d3fe190d..c1d8470e3 100644
--- a/mobile/shop/_common.php
+++ b/mobile/shop/_common.php
@@ -1,7 +1,8 @@
 <?php
 include_once('../../common.php');
 
-if (isset($_REQUEST['sort']))  {
+// SQL 주석 토큰 차단 추가 — 데스크톱 shop/_common.php 와 동일 패턴
+if (isset($_REQUEST['sort']) && !preg_match("/(--|#|\/\*|\*\/)/", $_REQUEST['sort']))  {
     $sort = trim($_REQUEST['sort']);
     $sort = preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\s]/", "", $sort);
 } else {
diff --git a/mobile/shop/listtype.php b/mobile/shop/listtype.php
index e3a453ceb..dee950022 100644
--- a/mobile/shop/listtype.php
+++ b/mobile/shop/listtype.php
@@ -1,6 +1,9 @@
 <?php
 include_once('./_common.php');
 
+// 상품 정렬 컬럼 화이트리스트 — 데스크톱 shop/listtype.php 와 동일 패턴
+$sort = (isset($_REQUEST['sort']) && in_array($_REQUEST['sort'], array('it_name', 'it_sum_qty', 'it_price', 'it_use_avg', 'it_use_cnt', 'it_update_time'))) ? $_REQUEST['sort'] : '';
+
 $type = isset($_REQUEST['type']) ? (int) preg_replace("/[^0-9]/", "", $_REQUEST['type']) : 1;
 if ($type === 1)      $g5['title'] = '히트상품';
 else if ($type === 2) $g5['title'] = '추천상품';