From d5619707bcaffc967081989830a371a2520691e5 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Wed, 6 May 2026 01:03:58 +0000
Subject: [PATCH] =?UTF-8?q?[security]=20=EC=9D=B8=EC=8A=A4=ED=86=A8?=
 =?UTF-8?q?=EB=9F=AC=20g5=5Fshop=5Fprefix=20PHP=20=EC=BD=94=EB=93=9C=20?=
 =?UTF-8?q?=EC=9D=B8=EC=A0=9D=EC=85=98(RCE)=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

install/install_db.php 의 g5_shop_prefix 가 dbconfig.php 의
define('G5_SHOP_TABLE_PREFIX','...') 문자열에 작은따옴표 escape 없이
삽입되어, 설치 전 노출된 인스톨러를 통해 임의 PHP 코드 주입 후 RCE
가능하던 문제를 수정. table_prefix·admin_id 와 동일하게 [^0-9a-z_]+
정규식 검증을 추가하여 영문자·숫자·언더스코어만 허용하도록 함.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 install/install_db.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/install/install_db.php b/install/install_db.php
index 4c47e1885..af1399f95 100644
--- a/install/install_db.php
+++ b/install/install_db.php
@@ -48,6 +48,10 @@ $g5_install = isset($_POST['g5_install']) ? (int) $_POST['g5_install'] : 0;
 $g5_shop_prefix = isset($_POST['g5_shop_prefix']) ? safe_install_string_check($_POST['g5_shop_prefix']) : 'yc5_';
 $g5_shop_install = isset($_POST['g5_shop_install']) ? (int) $_POST['g5_shop_install'] : 0;
 
+if (preg_match("/[^0-9a-z_]+/i", $g5_shop_prefix)) {
+    die('<div class="ins_inner"><p>쇼핑몰 TABLE명 접두사는 영문자, 숫자, _ 만 입력하세요.</p><div class="inner_btn"><a href="./install_config.php">뒤로가기</a></div></div>');
+}
+
 $dblink = sql_connect($mysql_host, $mysql_user, $mysql_pass, $mysql_db);
 if (!$dblink) {
 ?>