OpenRediect 취약점 수정

2024-01-25 16:50:47 +09:00
parent cb6b39cb60
commit 15f2037790
2 changed files with 3 additions and 2 deletions
--- a/bbs/logout.php
+++ b/bbs/logout.php
@ -19,7 +19,7 @@ if ($url) {
    if ( substr($url, 0, 2) == '//' )
        $url = 'http:' . $url;

-    $p = @parse_url(urldecode($url));
+    $p = @parse_url(urldecode(str_replace('\\', '', $url)));
    /*
        // OpenRediect 취약점관련, PHP 5.3 이하버전에서는 parse_url 버그가 있음 ( Safflower 님 제보 ) 아래 url 예제
        // http://localhost/bbs/logout.php?url=http://sir.kr%23@/