firstgarden/firstgarden-web-gnu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

[KVE-2023-0046] 그누보드5(gnuboard5) SQL Injection 취약점

Browse Source
This commit is contained in:
thisgun
2023-01-13 11:00:00 +09:00
parent 9cf8804611
commit 724a4e4bf6
2 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
mobile/shop/listtype.php
View File

@ -1,12 +1,12 @@
<?php
include_once('./_common.php');
$type = isset($_REQUEST['type']) ? preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\s]/", "", $_REQUEST['type']) : '';
if ($type == 1) $g5['title'] = '히트상품';
else if ($type == 2) $g5['title'] = '추천상품';
else if ($type == 3) $g5['title'] = '최신상품';
else if ($type == 4) $g5['title'] = '인기상품';
else if ($type == 5) $g5['title'] = '세일상품';
$type = isset($_REQUEST['type']) ? (int) preg_replace("/[^0-9]/", "", $_REQUEST['type']) : 1;
if ($type === 1) $g5['title'] = '히트상품';
else if ($type === 2) $g5['title'] = '추천상품';
else if ($type === 3) $g5['title'] = '최신상품';
else if ($type === 4) $g5['title'] = '인기상품';
else if ($type === 5) $g5['title'] = '세일상품';
else
alert('상품유형이 아닙니다.');

12
shop/listtype.php
View File

@ -3,18 +3,18 @@ include_once('./_common.php');
// 상품 리스트에서 다른 필드로 정렬을 하려면 아래의 배열 코드에서 해당 필드를 추가하세요.
$sort = (isset($_REQUEST['sort']) && in_array($_REQUEST['sort'], array('it_name', 'it_sum_qty', 'it_price', 'it_use_avg', 'it_use_cnt', 'it_update_time'))) ? $_REQUEST['sort'] : '';
$type = isset($_REQUEST['type']) ? preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\s]/", "", $_REQUEST['type']) : '';
$type = isset($_REQUEST['type']) ? (int) preg_replace("/[^0-9]/", "", $_REQUEST['type']) : 1;
if (G5_IS_MOBILE) {
include_once(G5_MSHOP_PATH.'/listtype.php');
return;
}
if ($type == 1) $g5['title'] = '히트상품';
else if ($type == 2) $g5['title'] = '추천상품';
else if ($type == 3) $g5['title'] = '최신상품';
else if ($type == 4) $g5['title'] = '인기상품';
else if ($type == 5) $g5['title'] = '할인상품';
if ($type === 1) $g5['title'] = '히트상품';
else if ($type === 2) $g5['title'] = '추천상품';
else if ($type === 3) $g5['title'] = '최신상품';
else if ($type === 4) $g5['title'] = '인기상품';
else if ($type === 5) $g5['title'] = '할인상품';
else
alert('상품유형이 아닙니다.');