[KVE-2018-2443] 영카트 SQL Injection 취약점 수정

2019-02-13 12:19:19 +09:00
parent f121c8e708
commit b6d9260f3a
3 changed files with 11 additions and 0 deletions
--- a/shop/_common.php
+++ b/shop/_common.php
@ -4,6 +4,7 @@ include_once('../common.php');
 if (isset($_REQUEST['sort']))  {
    $sort = trim($_REQUEST['sort']);
    $sort = preg_replace("/[\<\>\'\"\\\'\\\"\%\=\(\)\s]/", "", $sort);
+    $sort = preg_replace("/(--|#|\/\*|\*\/)/", "", $sort);
 } else {
    $sort = '';
 }