From 9773c13d5d788eaac51b2aa151eb2973dbd1ee3d Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Tue, 28 May 2019 11:57:58 +0900
Subject: [PATCH] =?UTF-8?q?KVE-2019-0724=20=EC=B7=A8=EC=95=BD=EC=A0=90=20?=
 =?UTF-8?q?=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/admin.lib.php      | 2 +-
 extend/sms5.extend.php | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/adm/admin.lib.php b/adm/admin.lib.php
index ececd06ab..3c99546d9 100644
--- a/adm/admin.lib.php
+++ b/adm/admin.lib.php
@@ -477,7 +477,7 @@ function admin_check_xss_params($params){
 
         if( is_array($value) ){
             admin_check_xss_params($value);
-        } else if ( preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/onload=.*/ius', $value)) ){
+        } else if ( preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/[onload|onerror]=.*/ius', $value)) ){
             alert('요청 쿼리에 잘못된 스크립트문장이 있습니다.\\nXSS 공격일수도 있습니다.');
             die();
         }
diff --git a/extend/sms5.extend.php b/extend/sms5.extend.php
index eee1022ef..dbef097cf 100644
--- a/extend/sms5.extend.php
+++ b/extend/sms5.extend.php
@@ -23,6 +23,8 @@ $g5['sms5_book_group_table']      = $g5['sms5_prefix'] . 'book_group';
 $g5['sms5_form_table']            = $g5['sms5_prefix'] . 'form';
 $g5['sms5_form_group_table']      = $g5['sms5_prefix'] . 'form_group';
 
+$sms5 = array();
+
 if (!empty($config['cf_sms_use'])) {
 
     $sms5 = sql_fetch("select * from {$g5['sms5_config_table']} ", false);