KVE-2018-0729 영카트 원격코드인젝션 취약점 수정

2018-09-06 13:34:49 +09:00
parent d21010276a
commit 3df899179f
2 changed files with 3 additions and 1 deletions
--- a/mobile/shop/inicis/pay_return.php
+++ b/mobile/shop/inicis/pay_return.php
@ -7,6 +7,8 @@ set_session('P_TID',  '');
 set_session('P_AMT',  '');
 set_session('P_HASH', '');

+$oid = preg_replace('/[^0-9a-z_-]/i', '', $oid);
+
 $sql = " select * from {$g5['g5_shop_order_data_table']} where od_id = '$oid' ";
 $row = sql_fetch($sql);