From b3fa6dc127c9c805db9ecf2c3eb3061a7d2a6cff Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Mon, 6 Apr 2026 05:44:31 +0000
Subject: [PATCH] =?UTF-8?q?[KVE-2026-0595]=EC=98=81=EC=B9=B4=ED=8A=B85=20S?=
 =?UTF-8?q?QL=20Injection=20=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98?=
 =?UTF-8?q?=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 lib/common.lib.php          |  3 ++-
 shop/settle_toss_common.php | 19 +++++++++++++------
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/lib/common.lib.php b/lib/common.lib.php
index 443e28949..b74adfc88 100644
--- a/lib/common.lib.php
+++ b/lib/common.lib.php
@@ -1754,7 +1754,8 @@ function sql_query($sql, $error=G5_DISPLAY_SQL_ERROR, $link=null)
     $sql = trim($sql);
     // union의 사용을 허락하지 않습니다.
     //$sql = preg_replace("#^select.*from.*union.*#i", "select 1", $sql);
-    $sql = preg_replace("#^select.*from.*[\s\(]+union[\s\)]+.*#i ", "select 1", $sql);
+    //$sql = preg_replace("#^select.*from.*[\s\(]+union[\s\)]+.*#i ", "select 1", $sql);
+    $sql = preg_replace("#^select.*from.*([\s\(]+union[\s\)]+|/\*.*union.*\*/).*#i", "select 1", $sql);
     // `information_schema` DB로의 접근을 허락하지 않습니다.
     $sql = preg_replace("#^select.*from.*where.*`?information_schema`?.*#i", "select 1", $sql);
 
diff --git a/shop/settle_toss_common.php b/shop/settle_toss_common.php
index 2c7f48f71..2a10a72af 100644
--- a/shop/settle_toss_common.php
+++ b/shop/settle_toss_common.php
@@ -49,12 +49,19 @@ if (!is_array($data)) {
     exit;
 }
 
-// 공통 필드 정리
-$TOSS_CREATEDAT = isset($data["createdAt"]) ? $data["createdAt"] : '';
-$TOSS_SECRET = isset($data["secret"]) ? $data["secret"] : '';
-$TOSS_ORDERID = isset($data["orderId"]) ? $data["orderId"] : '';
-$TOSS_STATUS = isset($data["status"]) ? $data["status"] : '';
-$TOSS_TRANSACTIONKEY = isset($data["transactionKey"]) ? $data["transactionKey"] : '';
+// 공통 필드 정리 (php://input은 전역 addslashes()를 거치지 않으므로 sql_real_escape_string 적용)
+$TOSS_CREATEDAT = sql_real_escape_string(isset($data["createdAt"]) ? $data["createdAt"] : '');
+$TOSS_SECRET = sql_real_escape_string(isset($data["secret"]) ? $data["secret"] : '');
+$TOSS_ORDERID = sql_real_escape_string(isset($data["orderId"]) ? $data["orderId"] : '');
+$TOSS_STATUS = sql_real_escape_string(isset($data["status"]) ? $data["status"] : '');
+$TOSS_TRANSACTIONKEY = sql_real_escape_string(isset($data["transactionKey"]) ? $data["transactionKey"] : '');
+
+// orderId 형식 검증 (영문, 숫자, 하이픈, 언더스코어만 허용)
+if ($TOSS_ORDERID && !preg_match('/^[a-zA-Z0-9_-]+$/', $TOSS_ORDERID)) {
+    write_toss_log("잘못된 orderId 형식", $TOSS_ORDERID, $TOSS_STATUS);
+    http_response_code(400);
+    exit;
+}
 
 // 결제 상세 조회
 $toss = new TossPayments(