From f69b66dcedf79cea759c0c75a6cf382917af9aff Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=B4=9D?= Date: Wed, 27 Aug 2025 11:48:36 +0900 Subject: [PATCH] =?UTF-8?q?[KVE-2025-0510]=20Stored=20XSS=20(bypass=20html?= =?UTF-8?q?=5Fpurify=20patch)=20to=20RCE=20=EC=B7=A8=EC=95=BD=EC=A0=90=20?= =?UTF-8?q?=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- adm/board_form.php | 14 ++++-- adm/board_form_update.php | 2 +- lib/common.lib.php | 2 +- mobile/shop/kcp/order_approval_form.php | 62 ++++++++++++------------- plugin/htmlpurifier/extend.video.php | 5 +- 5 files changed, 46 insertions(+), 39 deletions(-) diff --git a/adm/board_form.php b/adm/board_form.php index 82de4248b..a28cd6aa6 100644 --- a/adm/board_form.php +++ b/adm/board_form.php @@ -1447,12 +1447,12 @@ function frm_check_file(){ jQuery(function($){ if( window.self !== window.top ){ // frame 또는 iframe을 사용할 경우 체크 - $("#bo_include_head, #bo_include_tail").on("change paste keyup", function(e) { - frm_check_file(); - }); - use_captcha_check(); } + + $("#bo_include_head, #bo_include_tail").on("change paste keyup", function(e) { + frm_check_file(); + }); }); function fboardform_submit(f) @@ -1487,10 +1487,14 @@ function fboardform_submit(f) return false; } + if (frm_check_file() == false) { + jQuery(window).scrollTop($('#bo_include_tail').offset().top - 30); + } + if( captcha_chk ) { } - + return true; } diff --git a/adm/board_form_update.php b/adm/board_form_update.php index b1c9af12d..dbd48dc39 100644 --- a/adm/board_form_update.php +++ b/adm/board_form_update.php @@ -37,7 +37,7 @@ $bo_include_head = isset($_POST['bo_include_head']) ? preg_replace(array("#[\\\] $bo_include_tail = isset($_POST['bo_include_tail']) ? preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($_POST['bo_include_tail'], 0, 255)) : ''; // 관리자가 자동등록방지를 사용해야 할 경우 -if ($board && (isset($board['bo_include_head']) && $board['bo_include_head'] !== $bo_include_head || $board['bo_include_tail'] !== $bo_include_tail) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()) { +if ($board && (isset($board['bo_include_head']) && $board['bo_include_head'] !== $bo_include_head || $board['bo_include_tail'] !== $bo_include_tail)) { include_once(G5_CAPTCHA_PATH . '/captcha.lib.php'); if (!chk_captcha()) { diff --git a/lib/common.lib.php b/lib/common.lib.php index 5fad9574d..a7ab4197c 100644 --- a/lib/common.lib.php +++ b/lib/common.lib.php @@ -4248,7 +4248,7 @@ function is_include_path_check($path='', $is_input='') return false; } - if (preg_match('/\/data\/(file|editor|qa|cache|member|member_image|session|tmp)\/[A-Za-z0-9_]{1,20}\//i', $replace_path) || preg_match('/pear(cmd)?\.php/i', $replace_path)){ + if (preg_match('/\/data\/(file|editor|qa|cache|member|member_image|session|tmp)\/[A-Za-z0-9_]{1,20}\//i', $replace_path) || preg_match('/pe(?:ar|cl)(?:cmd)?\.php/i', $replace_path)){ return false; } if( preg_match('/'.G5_PLUGIN_DIR.'\//i', $replace_path) && (preg_match('/'.G5_OKNAME_DIR.'\//i', $replace_path) || preg_match('/'.G5_KCPCERT_DIR.'\//i', $replace_path) || preg_match('/'.G5_LGXPAY_DIR.'\//i', $replace_path)) || (preg_match('/search\.skin\.php/i', $replace_path) ) ){ diff --git a/mobile/shop/kcp/order_approval_form.php b/mobile/shop/kcp/order_approval_form.php index 1c325d7da..9da35e7ce 100644 --- a/mobile/shop/kcp/order_approval_form.php +++ b/mobile/shop/kcp/order_approval_form.php @@ -37,7 +37,7 @@ include_once('./_common.php'); $tran_cd = isset($_POST["tran_cd"]) ? $_POST["tran_cd"] : ''; // 트랜잭션 코드 $ordr_idxx = isset($_POST["ordr_idxx"]) ? $_POST["ordr_idxx"] : ''; // 쇼핑몰 주문번호 $good_name = isset($_POST["good_name"]) ? $_POST["good_name"] : ''; // 상품명 - $good_mny = isset($_POST["good_mny"]) ? $_POST["good_mny"] : ''; // 결제 총금액 + $good_mny = isset($_POST["good_mny"]) ? (int) $_POST["good_mny"] : ''; // 결제 총금액 $buyr_name = isset($_POST["buyr_name"]) ? $_POST["buyr_name"] : ''; // 주문자명 $buyr_tel1 = isset($_POST["buyr_tel1"]) ? $_POST["buyr_tel1"] : ''; // 주문자 전화번호 $buyr_tel2 = isset($_POST["buyr_tel2"]) ? $_POST["buyr_tel2"] : ''; // 주문자 핸드폰 번호 @@ -60,9 +60,9 @@ include_once('./_common.php'); $bask_cntx = isset($_POST["bask_cntx"]) ? $_POST["bask_cntx"] : ''; // 장바구니 상품수 $tablet_size = isset($_POST["tablet_size"]) ? $_POST["tablet_size"] : ''; // 모바일기기 화면비율 - $comm_tax_mny = isset($_POST["comm_tax_mny"]) ? $_POST["comm_tax_mny"] : ''; // 과세금액 - $comm_vat_mny = isset($_POST["comm_vat_mny"]) ? $_POST["comm_vat_mny"] : ''; // 부가세 - $comm_free_mny = isset($_POST["comm_free_mny"]) ? $_POST["comm_free_mny"] : ''; // 비과세금액 + $comm_tax_mny = isset($_POST["comm_tax_mny"]) ? (int) $_POST["comm_tax_mny"] : ''; // 과세금액 + $comm_vat_mny = isset($_POST["comm_vat_mny"]) ? (int) $_POST["comm_vat_mny"] : ''; // 부가세 + $comm_free_mny = isset($_POST["comm_free_mny"]) ? (int) $_POST["comm_free_mny"] : ''; // 비과세금액 $payco_direct = isset($_POST["payco_direct"]) ? $_POST["payco_direct"] : ''; // PAYCO 결제창 호출 $naverpay_direct = isset($_POST["naverpay_direct"]) ? $_POST["naverpay_direct"] : ''; // NAVERPAY 결제창 호출 @@ -253,7 +253,7 @@ if($enc_data != '' && $enc_info != '' && $tran_cd != '') { echo make_order_field($data, $exclude); foreach($_POST as $key=>$value) { - echo ''.PHP_EOL; + echo ''.PHP_EOL; } echo ''.PHP_EOL; @@ -262,12 +262,12 @@ if($enc_data != '' && $enc_info != '' && $tran_cd != '') {
- + - - - - + + + + - + - + - + - + @@ -311,29 +311,29 @@ if($enc_data != '' && $enc_info != '' && $tran_cd != '') { - + - + - + - + - + - + - + - + - + - + - + @@ -343,7 +343,7 @@ if($enc_data != '' && $enc_info != '' && $tran_cd != '') { - + - - - + + + +

결제가 실패한 경우 아래 돌아가기 버튼을 클릭해주세요.

- 돌아가기 + 돌아가기