gper/Gnuboard5
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[KVE-2026-0569]그누보드,영카트 SQL Injection 취약점 수정

Browse Source
This commit is contained in:
thisgun
2026-03-30 11:50:30 +00:00
parent bf19cd8bf5
commit c3db9b454e
7 changed files with 34 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
adm/shop_admin/inorderformupdate.php
+14 -14
View File
@@ -212,28 +212,28 @@ if($data['od_settle_case'] == 'KAKAOPAY')
$od_pg = 'KAKAOPAY';
$od_email = get_email_address($data['od_email']);
$od_name = clean_xss_tags($data['od_name']);
$od_tel = clean_xss_tags($data['od_tel']);
$od_hp = clean_xss_tags($data['od_hp']);
$od_name = addslashes(clean_xss_tags($data['od_name']));
$od_tel = addslashes(clean_xss_tags($data['od_tel']));
$od_hp = addslashes(clean_xss_tags($data['od_hp']));
$od_zip = preg_replace('/[^0-9]/', '', $data['od_zip']);
$od_zip1 = substr($od_zip, 0, 3);
$od_zip2 = substr($od_zip, 3);
$od_addr1 = clean_xss_tags($data['od_addr1']);
$od_addr2 = clean_xss_tags($data['od_addr2']);
$od_addr3 = clean_xss_tags($data['od_addr3']);
$od_addr1 = addslashes(clean_xss_tags($data['od_addr1']));
$od_addr2 = addslashes(clean_xss_tags($data['od_addr2']));
$od_addr3 = addslashes(clean_xss_tags($data['od_addr3']));
$od_addr_jibeon = preg_match("/^(N|R)$/", $data['od_addr_jibeon']) ? $data['od_addr_jibeon'] : '';
$od_b_name = clean_xss_tags($data['od_b_name']);
$od_b_tel = clean_xss_tags($data['od_b_tel']);
$od_b_hp = clean_xss_tags($data['od_b_hp']);
$od_b_name = addslashes(clean_xss_tags($data['od_b_name']));
$od_b_tel = addslashes(clean_xss_tags($data['od_b_tel']));
$od_b_hp = addslashes(clean_xss_tags($data['od_b_hp']));
$od_b_zip = preg_replace('/[^0-9]/', '', $data['od_b_zip']);
$od_b_zip1 = substr($od_b_zip, 0, 3);
$od_b_zip2 = substr($od_b_zip, 3);
$od_b_addr1 = clean_xss_tags($data['od_b_addr1']);
$od_b_addr2 = clean_xss_tags($data['od_b_addr2']);
$od_b_addr3 = clean_xss_tags($data['od_b_addr3']);
$od_b_addr1 = addslashes(clean_xss_tags($data['od_b_addr1']));
$od_b_addr2 = addslashes(clean_xss_tags($data['od_b_addr2']));
$od_b_addr3 = addslashes(clean_xss_tags($data['od_b_addr3']));
$od_b_addr_jibeon = preg_match("/^(N|R)$/", $data['od_b_addr_jibeon']) ? $data['od_b_addr_jibeon'] : '';
$od_memo = clean_xss_tags($data['od_memo'], 0, 1, 0, 0);
$od_deposit_name = clean_xss_tags($data['od_deposit_name']);
$od_memo = addslashes(clean_xss_tags($data['od_memo'], 0, 1, 0, 0));
$od_deposit_name = addslashes(clean_xss_tags($data['od_deposit_name']));
$od_tax_flag = $default['de_tax_flag_use'];
$od_receipt_price = $tot_ct_price + $od_send_cost + $od_send_cost2 - ($od_temp_point + $tot_cp_price + $tot_sc_cp_price);
$od_receipt_point = $od_temp_point;
bbs/register_form_update.php
+6 -6
View File
@@ -63,15 +63,15 @@ $mb_7 = isset($_POST['mb_7']) ? trim($_POST['mb_7'])
$mb_8 = isset($_POST['mb_8']) ? trim($_POST['mb_8']) : "";
$mb_9 = isset($_POST['mb_9']) ? trim($_POST['mb_9']) : "";
$mb_10 = isset($_POST['mb_10']) ? trim($_POST['mb_10']) : "";
$mb_name = clean_xss_tags($mb_name, 1, 1);
$mb_name = addslashes(clean_xss_tags(stripslashes($mb_name), 1, 1));
$mb_email = get_email_address($mb_email);
$mb_homepage = clean_xss_tags($mb_homepage, 1, 1);
$mb_tel = clean_xss_tags($mb_tel, 1, 1);
$mb_homepage = addslashes(clean_xss_tags(stripslashes($mb_homepage), 1, 1));
$mb_tel = addslashes(clean_xss_tags(stripslashes($mb_tel), 1, 1));
$mb_zip1 = preg_replace('/[^0-9]/', '', $mb_zip1);
$mb_zip2 = preg_replace('/[^0-9]/', '', $mb_zip2);
$mb_addr1 = clean_xss_tags($mb_addr1, 1, 1);
$mb_addr2 = clean_xss_tags($mb_addr2, 1, 1);
$mb_addr3 = clean_xss_tags($mb_addr3, 1, 1);
$mb_addr1 = addslashes(clean_xss_tags(stripslashes($mb_addr1), 1, 1));
$mb_addr2 = addslashes(clean_xss_tags(stripslashes($mb_addr2), 1, 1));
$mb_addr3 = addslashes(clean_xss_tags(stripslashes($mb_addr3), 1, 1));
$mb_addr_jibeon = preg_match("/^(N|R)$/", $mb_addr_jibeon) ? $mb_addr_jibeon : '';
$mb_marketing_agree = isset($_POST['mb_marketing_agree']) ? trim($_POST['mb_marketing_agree']) : "0";
mobile/shop/inicis/pay_approval.php
+4 -4
View File
@@ -132,10 +132,10 @@ if(isset($data['pp_id']) && !empty($data['pp_id'])) {
}
$good_mny = isset($PAY['P_AMT']) ? $PAY['P_AMT'] : 0;
$pp_name = clean_xss_tags($data['pp_name']);
$pp_email = clean_xss_tags($data['pp_email']);
$pp_hp = clean_xss_tags($data['pp_hp']);
$pp_settle_case = clean_xss_tags($data['pp_settle_case']);
$pp_name = addslashes(clean_xss_tags($data['pp_name']));
$pp_email = addslashes(clean_xss_tags($data['pp_email']));
$pp_hp = addslashes(clean_xss_tags($data['pp_hp']));
$pp_settle_case = addslashes(clean_xss_tags($data['pp_settle_case']));
$_POST['P_HASH'] = $hash;
$_POST['P_AUTH_NO'] = isset($PAY['P_AUTH_NO']) ? $PAY['P_AUTH_NO'] : '';
mobile/shop/inicis/settle_common.php
+4 -4
View File
@@ -124,10 +124,10 @@ if($PGIP == "211.219.96.165" || $PGIP == "118.129.210.25" || $PGIP == "183.109.7
}
$good_mny = $P_AMT;
$pp_name = clean_xss_tags($data['pp_name']);
$pp_email = clean_xss_tags($data['pp_email']);
$pp_hp = clean_xss_tags($data['pp_hp']);
$pp_settle_case = clean_xss_tags($data['pp_settle_case']);
$pp_name = addslashes(clean_xss_tags($data['pp_name']));
$pp_email = addslashes(clean_xss_tags($data['pp_email']));
$pp_hp = addslashes(clean_xss_tags($data['pp_hp']));
$pp_settle_case = addslashes(clean_xss_tags($data['pp_settle_case']));
set_session('P_TID', $P_TID);
set_session('P_AMT', $P_AMT);
mobile/shop/orderformupdate.php
+1 -1
View File
@@ -1002,7 +1002,7 @@ if($is_member) {
sql_query($sql);
}
$ad_subject = clean_xss_tags($ad_subject);
$ad_subject = addslashes(clean_xss_tags(stripslashes($ad_subject)));
if($row['ad_id']){
$sql = " update {$g5['g5_shop_order_address_table']}
shop/kakaopay/mobile_pay_approval.php
+4 -4
View File
@@ -138,10 +138,10 @@ if(isset($data['pp_id']) && !empty($data['pp_id'])) {
}
$good_mny = $PAY['P_AMT'];
$pp_name = clean_xss_tags($data['pp_name']);
$pp_email = clean_xss_tags($data['pp_email']);
$pp_hp = clean_xss_tags($data['pp_hp']);
$pp_settle_case = clean_xss_tags($data['pp_settle_case']);
$pp_name = addslashes(clean_xss_tags($data['pp_name']));
$pp_email = addslashes(clean_xss_tags($data['pp_email']));
$pp_hp = addslashes(clean_xss_tags($data['pp_hp']));
$pp_settle_case = addslashes(clean_xss_tags($data['pp_settle_case']));
$_POST['P_HASH'] = $hash;
$_POST['P_AUTH_NO'] = $PAY['P_AUTH_NO'];
shop/orderformupdate.php
+1 -1
View File
@@ -953,7 +953,7 @@ if($is_member) {
sql_query($sql);
}
$ad_subject = isset($_POST['ad_subject']) ? clean_xss_tags($_POST['ad_subject']) : '';
$ad_subject = isset($_POST['ad_subject']) ? addslashes(clean_xss_tags(stripslashes($_POST['ad_subject']))) : '';
if(isset($row['ad_id']) && $row['ad_id']){
$sql = " update {$g5['g5_shop_order_address_table']}