관리자 페이지 원격 명령 실행 취약점 수정

2024-02-14 19:09:20 +09:00
parent 8d912e3511
commit 248cb2b173
7 changed files with 14 additions and 10 deletions
--- a/shop/event.php
+++ b/shop/event.php
@ -50,7 +50,7 @@ else
    $order_by = 'b.it_order, b.it_id desc';

 if ($skin) {
-    $skin = preg_replace('#\.+(\/|\\\)#', '', $skin);
+    $skin = preg_replace(array('#\.+(\/|\\\)#', '#[\'\"]#'), array('', ''), $skin);
    $ev['ev_skin'] = $skin;
 }