gper/Gnuboard5
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[KVE-2026-0595]영카트5 SQL Injection 취약점 수정

Browse Source
This commit is contained in:
thisgun
2026-04-06 06:26:20 +00:00
parent e6780f3b4b
commit b3fa6dc127
2 changed files with 15 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/common.lib.php
+2 -1
View File
@@ -1754,7 +1754,8 @@ function sql_query($sql, $error=G5_DISPLAY_SQL_ERROR, $link=null)
$sql = trim($sql);
// union의 사용을 허락하지 않습니다.
//$sql = preg_replace("#^select.*from.*union.*#i", "select 1", $sql);
$sql = preg_replace("#^select.*from.*[\s\(]+union[\s\)]+.*#i ", "select 1", $sql);
//$sql = preg_replace("#^select.*from.*[\s\(]+union[\s\)]+.*#i ", "select 1", $sql);
$sql = preg_replace("#^select.*from.*([\s\(]+union[\s\)]+|/\*.*union.*\*/).*#i", "select 1", $sql);
// `information_schema` DB로의 접근을 허락하지 않습니다.
$sql = preg_replace("#^select.*from.*where.*`?information_schema`?.*#i", "select 1", $sql);
shop/settle_toss_common.php
+13 -6
View File
@@ -49,12 +49,19 @@ if (!is_array($data)) {
exit;
}
// 공통 필드 정리
$TOSS_CREATEDAT = isset($data["createdAt"]) ? $data["createdAt"] : '';
$TOSS_SECRET = isset($data["secret"]) ? $data["secret"] : '';
$TOSS_ORDERID = isset($data["orderId"]) ? $data["orderId"] : '';
$TOSS_STATUS = isset($data["status"]) ? $data["status"] : '';
$TOSS_TRANSACTIONKEY = isset($data["transactionKey"]) ? $data["transactionKey"] : '';
// 공통 필드 정리 (php://input은 전역 addslashes()를 거치지 않으므로 sql_real_escape_string 적용)
$TOSS_CREATEDAT = sql_real_escape_string(isset($data["createdAt"]) ? $data["createdAt"] : '');
$TOSS_SECRET = sql_real_escape_string(isset($data["secret"]) ? $data["secret"] : '');
$TOSS_ORDERID = sql_real_escape_string(isset($data["orderId"]) ? $data["orderId"] : '');
$TOSS_STATUS = sql_real_escape_string(isset($data["status"]) ? $data["status"] : '');
$TOSS_TRANSACTIONKEY = sql_real_escape_string(isset($data["transactionKey"]) ? $data["transactionKey"] : '');
// orderId 형식 검증 (영문, 숫자, 하이픈, 언더스코어만 허용)
if ($TOSS_ORDERID && !preg_match('/^[a-zA-Z0-9_-]+$/', $TOSS_ORDERID)) {
write_toss_log("잘못된 orderId 형식", $TOSS_ORDERID, $TOSS_STATUS);
http_response_code(400);
exit;
}
// 결제 상세 조회
$toss = new TossPayments(