gper/Gnuboard5
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[KVE-2026-0595]영카트5 SQL Injection 취약점 수정

Browse Source
This commit is contained in:
thisgun
2026-04-06 06:26:20 +00:00
parent e6780f3b4b
commit b3fa6dc127
2 changed files with 15 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/common.lib.php
+2 -1
View File
@@ -1754,7 +1754,8 @@ function sql_query($sql, $error=G5_DISPLAY_SQL_ERROR, $link=null)
$sql = trim($sql);
// union의 사용을 허락하지 않습니다.
//$sql = preg_replace("#^select.*from.*union.*#i", "select 1", $sql);
$sql = preg_replace("#^select.*from.*[\s\(]+union[\s\)]+.*#i ", "select 1", $sql);
//$sql = preg_replace("#^select.*from.*[\s\(]+union[\s\)]+.*#i ", "select 1", $sql);
$sql = preg_replace("#^select.*from.*([\s\(]+union[\s\)]+|/\*.*union.*\*/).*#i", "select 1", $sql);
// `information_schema` DB로의 접근을 허락하지 않습니다.
$sql = preg_replace("#^select.*from.*where.*`?information_schema`?.*#i", "select 1", $sql);