diff --git a/adm/popular_list.php b/adm/popular_list.php
index da83d1caa..e2d16888b 100644
--- a/adm/popular_list.php
+++ b/adm/popular_list.php
@@ -6,6 +6,8 @@ auth_check_menu($auth, $sub_menu, 'r');
 
 // 체크된 자료 삭제
 if (isset($_POST['chk']) && is_array($_POST['chk'])) {
+    check_admin_token();
+
     for ($i = 0; $i < count($_POST['chk']); $i++) {
         $pp_id = (int) $_POST['chk'][$i];
 
diff --git a/adm/shop_admin/itemformupdate.php b/adm/shop_admin/itemformupdate.php
index 52ee641ee..2b468a90b 100644
--- a/adm/shop_admin/itemformupdate.php
+++ b/adm/shop_admin/itemformupdate.php
@@ -365,6 +365,32 @@ $it_explan = isset($_POST['it_explan']) ? $_POST['it_explan'] : '';
 if ($it_name == "")
     alert("상품명을 입력해 주십시오.");
 
+// 스킨 경로 검증
+$it_skin = isset($_POST['it_skin']) ? strip_tags(clean_xss_attributes($_POST['it_skin'])) : '';
+$it_mobile_skin = isset($_POST['it_mobile_skin']) ? strip_tags(clean_xss_attributes($_POST['it_mobile_skin'])) : '';
+
+$check_files = array();
+if( !empty($it_skin) )          $check_files[] = $it_skin;
+if( !empty($it_mobile_skin) )   $check_files[] = $it_mobile_skin;
+
+foreach( $check_files as $file ){
+    if( empty($file) ) continue;
+
+    if( preg_match('#\.+(\/|\\\)#', $file) ){
+        alert('스킨파일명에 포함될수 없는 문자가 들어있습니다.');
+    }
+
+    if( ! is_include_path_check($file) ){
+        alert('오류 : 데이터폴더가 포함된 path 또는 잘못된 path 를 포함할수 없습니다.');
+    }
+
+    $file_ext = pathinfo($file, PATHINFO_EXTENSION);
+
+    if( ! $file_ext || ! in_array($file_ext, array('php', 'htm', 'html')) || ! preg_match('/^.*\.(php|htm|html)$/i', $file) ) {
+        alert('스킨 파일 경로의 확장자는 php, htm, html 만 허용합니다.');
+    }
+}
+
 $sql_common = " ca_id               = '$ca_id',
                 ca_id2              = '$ca_id2',
                 ca_id3              = '$ca_id3',
diff --git a/adm/sms_admin/form_list.php b/adm/sms_admin/form_list.php
index 4322c2b7c..dbfcb5a62 100644
--- a/adm/sms_admin/form_list.php
+++ b/adm/sms_admin/form_list.php
@@ -65,7 +65,7 @@ function book_all_checked(chk)
 function book_del(fo_no)
 {
     if (confirm("한번 삭제한 자료는 복구할 방법이 없습니다.\n\n그래도 삭제하시겠습니까?"))
-        location.href = "./form_update.php?w=d&fo_no=" + fo_no + "&page=<?php echo $page?>&fg_no=<?php echo $fg_no?>&st=<?php echo get_text($st); ?>&sv=<?php echo get_text($sv); ?>";
+        location.href = "./form_update.php?w=d&fo_no=" + fo_no + "&page=<?php echo $page?>&fg_no=<?php echo $fg_no?>&st=<?php echo get_text($st); ?>&sv=<?php echo get_text($sv); ?>&token=<?php echo $token; ?>";
 }
 
 function multi_update(sel)
diff --git a/adm/sms_admin/form_update.php b/adm/sms_admin/form_update.php
index c086cb059..7662c32b8 100644
--- a/adm/sms_admin/form_update.php
+++ b/adm/sms_admin/form_update.php
@@ -4,6 +4,8 @@ include_once("./_common.php");
 
 auth_check_menu($auth, $sub_menu, "w");
 
+check_admin_token();
+
 $fo_name = isset($_REQUEST['fo_name']) ? strip_tags(clean_xss_attributes($_REQUEST['fo_name'])) : '';
 $fo_content = isset($_REQUEST['fo_content']) ? strip_tags(clean_xss_attributes($_REQUEST['fo_content'])) : '';
 $fo_receipt = isset($_REQUEST['fo_receipt']) ? clean_xss_tags($_REQUEST['fo_receipt'], 1, 1) : '';
diff --git a/adm/sms_admin/form_write.php b/adm/sms_admin/form_write.php
index 102263449..4123674ca 100644
--- a/adm/sms_admin/form_write.php
+++ b/adm/sms_admin/form_write.php
@@ -4,6 +4,8 @@ include_once("./_common.php");
 
 auth_check_menu($auth, $sub_menu, "w");
 
+$token = get_token();
+
 $g5['title'] = "이모티콘 ";
 
 $fo_no = isset($_REQUEST['fo_no']) ? (int) $_REQUEST['fo_no'] : 0;
@@ -34,6 +36,7 @@ include_once(G5_ADMIN_PATH.'/admin.head.php');
 <input type="hidden" name="page" value="<?php echo $page?>">
 <input type="hidden" name="fo_no" value="<?php echo $write['fo_no']; ?>">
 <input type="hidden" name="get_fg_no" value="<?php echo $fg_no?>">
+<input type="hidden" name="token" value="<?php echo $token; ?>">
 
     <div class="tbl_frm01 tbl_wrap">
     <table>
diff --git a/adm/sms_admin/member_update.php b/adm/sms_admin/member_update.php
index 0008c794f..6b6b5caa7 100644
--- a/adm/sms_admin/member_update.php
+++ b/adm/sms_admin/member_update.php
@@ -4,6 +4,8 @@ include_once("./_common.php");
 
 auth_check_menu($auth, $sub_menu, "r");
 
+$token = get_token();
+
 $g5['title'] = "회원정보 업데이트";
 
 include_once(G5_ADMIN_PATH.'/admin.head.php');
@@ -37,7 +39,7 @@ include_once(G5_ADMIN_PATH.'/admin.head.php');
     $( "#mb_update_form" ).submit(function( e ) {
         e.preventDefault();
         $("#res_msg").html('업데이트 중입니다. 잠시만 기다려 주십시오...');
-        var params = { mtype : 'json' };
+        var params = { mtype : 'json', token : '<?php echo $token; ?>' };
         $.ajax({
             url: $(this).attr("action"),
             cache:false,
diff --git a/adm/sms_admin/member_update_run.php b/adm/sms_admin/member_update_run.php
index aeea60f48..bb8603b5b 100644
--- a/adm/sms_admin/member_update_run.php
+++ b/adm/sms_admin/member_update_run.php
@@ -26,6 +26,8 @@ if( $mtype == "json" ){
     auth_check_menu($auth, $sub_menu, "w");
 }
 
+check_admin_token();
+
 $count      = 0;
 $hp_yes     = 0;
 $hp_no      = 0;
diff --git a/plugin/okname/find_hpcert2.php b/plugin/okname/find_hpcert2.php
index 0e0bc5fa3..ad0181a0f 100644
--- a/plugin/okname/find_hpcert2.php
+++ b/plugin/okname/find_hpcert2.php
@@ -125,18 +125,19 @@ if (empty($row['mb_id'])) { // ci로 등록된 계정이 없다면
     $mb_dupinfo = $md5_ci;
 }
 
-$md5_cert_no = md5($cert_no);
-$hash_data   = md5($user_name.$cert_type.$birth_day.$phone_no.$md5_cert_no);
+$cert_type = 'hp';
+$md5_cert_no = md5($req_num);
+$hash_data   = md5($mb_name.$cert_type.$mb_birth.$phone_no.$md5_cert_no);
 
 // 성인인증결과
 $adult_day = date("Ymd", strtotime("-19 years", G5_SERVER_TIME));
-$adult = ((int)$birth_day <= (int)$adult_day) ? 1 : 0;
+$adult = ((int)$mb_birth <= (int)$adult_day) ? 1 : 0;
 
 set_session("ss_cert_type",    $cert_type);
 set_session("ss_cert_no",      $md5_cert_no);
 set_session("ss_cert_hash",    $hash_data);
 set_session("ss_cert_adult",   $adult);
-set_session("ss_cert_birth",   $birth_day);
+set_session("ss_cert_birth",   $mb_birth);
 set_session('ss_cert_sex',     ($field[9] == 1 ? 'M' : 'F'));
 set_session('ss_cert_dupinfo', $mb_dupinfo);
 set_session('ss_cert_mb_id', $row['mb_id']);
diff --git a/plugin/okname/find_ipin2.php b/plugin/okname/find_ipin2.php
index f617791c0..b28f6388a 100644
--- a/plugin/okname/find_ipin2.php
+++ b/plugin/okname/find_ipin2.php
@@ -99,18 +99,19 @@ if (empty($row['mb_id'])) { // ci로 등록된 계정이 없다면
     $mb_dupinfo = $md5_ci;
 }
 
-$md5_cert_no = md5($cert_no);
-$hash_data   = md5($user_name.$cert_type.$birth_day.$phone_no.$md5_cert_no);
+$cert_type = 'ipin';
+$md5_cert_no = md5($req_num);
+$hash_data   = md5($mb_name.$cert_type.$mb_birth.$md5_cert_no);
 
 // 성인인증결과
 $adult_day = date("Ymd", strtotime("-19 years", G5_SERVER_TIME));
-$adult = ((int)$birth_day <= (int)$adult_day) ? 1 : 0;
+$adult = ((int)$mb_birth <= (int)$adult_day) ? 1 : 0;
 
 set_session("ss_cert_type",    $cert_type);
 set_session("ss_cert_no",      $md5_cert_no);
 set_session("ss_cert_hash",    $hash_data);
 set_session("ss_cert_adult",   $adult);
-set_session("ss_cert_birth",   $birth_day);
+set_session("ss_cert_birth",   $mb_birth);
 set_session('ss_cert_sex',     ($field[9] == 1 ? 'M' : 'F'));
 set_session('ss_cert_dupinfo', $mb_dupinfo);
 set_session('ss_cert_mb_id', $row['mb_id']);
diff --git a/plugin/social/unlink.php b/plugin/social/unlink.php
index ca4b4cdfe..525c643d4 100644
--- a/plugin/social/unlink.php
+++ b/plugin/social/unlink.php
@@ -26,7 +26,7 @@ if($mp_no){
     $sql = "SELECT * from {$g5['social_profile_table']} where mb_id= '".$mb_id."' and mp_no= $mp_no";
     $row = sql_fetch($sql);
 } else if($provider){
-    $sql = "SELECT * from {$g5['social_profile_table']} where mb_id= '".$mb_id."' and provider= '".$provider."'";
+    $sql = "SELECT * from {$g5['social_profile_table']} where mb_id= '".$mb_id."' and provider= '".sql_real_escape_string($provider)."'";
     $row = sql_fetch($sql);
 }