From 588a1a7c9d0762627fe5373f58d1f13bd4adbb43 Mon Sep 17 00:00:00 2001
From: chicpro <chicpro@gmail.com>
Date: Tue, 7 Apr 2015 09:50:14 +0900
Subject: [PATCH 1/2] =?UTF-8?q?sms5=20sql=20injection=20=EC=B7=A8=EC=95=BD?=
 =?UTF-8?q?=EC=A0=90=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/sms_admin/history_send.php   | 2 +-
 adm/sms_admin/sms_write_send.php | 9 ++++++---
 plugin/sms5/write_update.php     | 7 +++++--
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/adm/sms_admin/history_send.php b/adm/sms_admin/history_send.php
index 5f6b468b7..a28d981fe 100644
--- a/adm/sms_admin/history_send.php
+++ b/adm/sms_admin/history_send.php
@@ -67,7 +67,7 @@ if ($result)
 
     if ($result) //SMS 서버에 접속했습니다.
     {
-        sql_query("insert into {$g5['sms5_write_table']} set wr_no='$wr_no', wr_renum='$new_wr_renum', wr_reply='{$write['wr_reply']}', wr_message='{$write['wr_message']}', wr_total='$wr_total', wr_datetime='".G5_TIME_YMDHIS."'");
+        sql_query("insert into {$g5['sms5_write_table']} set wr_no='$wr_no', wr_renum='$new_wr_renum', wr_reply='".addslashes($write['wr_reply'])."', wr_message='".addslashes($write['wr_message'])."', wr_total='$wr_total', wr_datetime='".G5_TIME_YMDHIS."'");
 
         $wr_success = 0;
         $wr_failure = 0;
diff --git a/adm/sms_admin/sms_write_send.php b/adm/sms_admin/sms_write_send.php
index c59301258..45646ffec 100644
--- a/adm/sms_admin/sms_write_send.php
+++ b/adm/sms_admin/sms_write_send.php
@@ -6,10 +6,13 @@ auth_check($auth[$sub_menu], "w");
 
 $g5['title'] = "문자전송중";
 
-if (!trim($wr_reply))
-    win_close_alert('회신 번호를 입력해주세요.');
+$wr_reply   = preg_replace('#[^0-9\-]#', '', trim($wr_reply));
+$wr_message = clean_xss_tags(trim($wr_message));
 
-if (!trim($wr_message))
+if (!$wr_reply)
+    win_close_alert('회신 번호를 숫자, - 로 입력해주세요.');
+
+if (!$wr_message)
     win_close_alert('메세지를 입력해주세요.');
 
 if (!trim($send_list))
diff --git a/plugin/sms5/write_update.php b/plugin/sms5/write_update.php
index a25e50b7b..6db482697 100644
--- a/plugin/sms5/write_update.php
+++ b/plugin/sms5/write_update.php
@@ -15,10 +15,13 @@ if (!$is_member)
 if ($member['mb_level'] < $sms5['cf_level'])
     alert("회원 {$sms5['cf_level']}레벨 이상만 문자전송이 가능합니다.");
 
-if (!trim($mh_reply))
+$mh_reply   = preg_replace('#[^0-9\-]#', '', trim($mh_reply));
+$mh_message = clean_xss_tags(trim($mh_message));
+
+if (!$mh_reply)
     alert('보내는 번호를 입력해주세요.');
 
-if (!trim($mh_message))
+if (!$mh_message)
     alert('메세지를 입력해주세요.');
 
 if ($is_admin != 'super')

From bed3d9982c9a40b00d57a8aa7aede8d3e0256a18 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Wed, 8 Apr 2015 11:54:59 +0900
Subject: [PATCH 2/2] =?UTF-8?q?SMS5=20=ED=9A=8C=EC=8B=A0=20=EB=B2=88?=
 =?UTF-8?q?=ED=98=B8=20=EC=B2=B4=ED=81=AC=ED=95=98=EB=8A=94=20=EC=9E=90?=
 =?UTF-8?q?=EB=B0=94=EC=8A=A4=ED=81=AC=EB=A6=BD=ED=8A=B8=20=EC=A0=95?=
 =?UTF-8?q?=EA=B7=9C=EC=8B=9D=20=EC=B6=94=EA=B0=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/sms_admin/sms_write.php | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/adm/sms_admin/sms_write.php b/adm/sms_admin/sms_write.php
index ee98ee8b4..89ec40562 100644
--- a/adm/sms_admin/sms_write.php
+++ b/adm/sms_admin/sms_write.php
@@ -238,6 +238,8 @@ function sms5_chk_send(f)
         var hp_list = document.getElementById('hp_list');
         var wr_message = document.getElementById('wr_message');
         var hp_number = document.getElementById('hp_number');
+        var wr_reply = document.getElementById('wr_reply');
+        var wr_reply_regExp = /^[0-9\-]+$/;
         var list = '';
 
         if (!wr_message.value) {
@@ -246,7 +248,12 @@ function sms5_chk_send(f)
             is_sms5_submitted = false;
             return false;
         }
-
+        if( !wr_reply_regExp.test(wr_reply.value) ){
+            alert('회신번호 형식이 잘못 되었습니다.');
+            wr_reply.focus();
+            is_sms5_submitted = false;
+            return false;
+        }
         if (hp_list.length < 1) {
             alert('받는 사람을 입력해주세요.');
             hp_number.focus();