[KVE-2020-0097]영카트_파일경로_RCE 취약점 수정

2020-03-03 11:50:14 +09:00
parent bd11ac4e8c
commit f7194bdd92
1 changed files with 5 additions and 0 deletions
--- a/adm/shop_admin/categoryformupdate.php
+++ b/adm/shop_admin/categoryformupdate.php
@ -56,6 +56,11 @@ foreach( $check_str_keys as $key ){
 $ca_include_head = $_POST['ca_include_head'];
 $ca_include_tail = $_POST['ca_include_tail'];

+if( function_exists('filter_input_include_path') ){
+    $ca_include_head = filter_input_include_path($ca_include_head);
+    $ca_include_tail = filter_input_include_path($ca_include_tail);
+}
+
 if ($w == "u" || $w == "d")
    check_demo();