영카트 Reflected XSS 취약점 수정( 17-0558 )

shop/bannerhit.php

@@ -1,6 +1,15 @@
 <?php
 include_once("./_common.php");
 
+$bn_id = (int) $bn_id;
+
+$sql = " select bn_id, bn_url from {$g5['g5_shop_banner_table']} where bn_id = '$bn_id' ";
+$row = sql_fetch($sql);
+
+if( ! $row['bn_id'] ){
+    alert('해당 배너가 존재하지 않습니다.', G5_SHOP_URL);
+}
+
 if ($_COOKIE['ck_bn_id'] != $bn_id)
 {
     $sql = " update {$g5['g5_shop_banner_table']} set bn_hit = bn_hit + 1 where bn_id = '$bn_id' ";
@@ -9,5 +18,7 @@ if ($_COOKIE['ck_bn_id'] != $bn_id)
     set_cookie("ck_bn_id", $bn_id, 60*60*24);
 }
 
+$url = clean_xss_tags($row['bn_url']);
+
 goto_url($url);
 ?>