영카트 Reflected XSS 취약점 수정( 17-0558 )

gnuboard · Sep 11, 2017 · adc0c4f · adc0c4f
1 parent 71c5a40
commit adc0c4f
Show file tree

Hide file tree

Showing 8 changed files with 19 additions and 6 deletions.
diff --git a/adm/shop_admin/bannerformupdate.php b/adm/shop_admin/bannerformupdate.php
@@ -34,6 +34,8 @@
     }
 }
 
+$bn_url = clean_xss_tags($bn_url);
+
 if ($w=="")
 {
     if (!$bn_bimg_name) alert('배너 이미지를 업로드 하세요.');

diff --git a/mobile/skin/shop/basic/mainbanner.10.skin.php b/mobile/skin/shop/basic/mainbanner.10.skin.php
@@ -39,7 +39,7 @@
         if ($row['bn_url'][0] == '#')
             $banner .= '<a href="'.$row['bn_url'].'">';
         else if ($row['bn_url'] && $row['bn_url'] != 'http://') {
-            $banner .= '<a href="'.G5_SHOP_URL.'/bannerhit.php?bn_id='.$row['bn_id'].'&amp;url='.urlencode($row['bn_url']).'"'.$bn_new_win.'>';
+            $banner .= '<a href="'.G5_SHOP_URL.'/bannerhit.php?bn_id='.$row['bn_id'].'"'.$bn_new_win.'>';
         }
         echo $banner.'<img src="'.G5_DATA_URL.'/banner/'.$row['bn_id'].'" width="'.$size[0].'" alt="'.$row['bn_alt'].'"'.$bn_border.'>';
         if($banner)

diff --git a/shop/bannerhit.php b/shop/bannerhit.php
@@ -1,6 +1,15 @@
 <?php
 include_once("./_common.php");
 
+$bn_id = (int) $bn_id;
+
+$sql = " select bn_id, bn_url from {$g5['g5_shop_banner_table']} where bn_id = '$bn_id' ";
+$row = sql_fetch($sql);
+
+if( ! $row['bn_id'] ){
+    alert('해당 배너가 존재하지 않습니다.', G5_SHOP_URL);
+}
+
 if ($_COOKIE['ck_bn_id'] != $bn_id)
 {
     $sql = " update {$g5['g5_shop_banner_table']} set bn_hit = bn_hit + 1 where bn_id = '$bn_id' ";
@@ -9,5 +18,7 @@
     set_cookie("ck_bn_id", $bn_id, 60*60*24);
 }
 
+$url = clean_xss_tags($row['bn_url']);
+
 goto_url($url);
 ?>
diff --git a/skin/shop/basic/boxbanner.skin.php b/skin/shop/basic/boxbanner.skin.php
@@ -25,7 +25,7 @@
         if ($row['bn_url'][0] == '#')
             $banner .= '<a href="'.$row['bn_url'].'">';
         else if ($row['bn_url'] && $row['bn_url'] != 'http://') {
-            $banner .= '<a href="'.G5_SHOP_URL.'/bannerhit.php?bn_id='.$row['bn_id'].'&amp;url='.urlencode($row['bn_url']).'"'.$bn_new_win.'>';
+            $banner .= '<a href="'.G5_SHOP_URL.'/bannerhit.php?bn_id='.$row['bn_id'].'"'.$bn_new_win.'>';
         }
         echo $banner.'<img src="'.G5_DATA_URL.'/banner/'.$row['bn_id'].'" alt="'.$row['bn_alt'].'" width="'.$size[0].'" height="'.$size[1].'"'.$bn_border.'>';
         if($banner)

diff --git a/skin/shop/basic/mainbanner.10.skin.php b/skin/shop/basic/mainbanner.10.skin.php
@@ -37,7 +37,7 @@
         if ($row['bn_url'][0] == '#')
             $banner .= '<a href="'.$row['bn_url'].'">';
         else if ($row['bn_url'] && $row['bn_url'] != 'http://') {
-            $banner .= '<a href="'.G5_SHOP_URL.'/bannerhit.php?bn_id='.$row['bn_id'].'&amp;url='.urlencode($row['bn_url']).'"'.$bn_new_win.'>';
+            $banner .= '<a href="'.G5_SHOP_URL.'/bannerhit.php?bn_id='.$row['bn_id'].'"'.$bn_new_win.'>';
         }
         echo $banner.'<img src="'.G5_DATA_URL.'/banner/'.$row['bn_id'].'" width="'.$size[0].'" alt="'.$row['bn_alt'].'"'.$bn_border.'>';
         if($banner)

diff --git a/theme/basic/mobile/skin/shop/basic/mainbanner.10.skin.php b/theme/basic/mobile/skin/shop/basic/mainbanner.10.skin.php
@@ -39,7 +39,7 @@
         if ($row['bn_url'][0] == '#')
             $banner .= '<a href="'.$row['bn_url'].'">';
         else if ($row['bn_url'] && $row['bn_url'] != 'http://') {
-            $banner .= '<a href="'.G5_SHOP_URL.'/bannerhit.php?bn_id='.$row['bn_id'].'&amp;url='.urlencode($row['bn_url']).'"'.$bn_new_win.'>';
+            $banner .= '<a href="'.G5_SHOP_URL.'/bannerhit.php?bn_id='.$row['bn_id'].'"'.$bn_new_win.'>';
         }
         echo $banner.'<img src="'.G5_DATA_URL.'/banner/'.$row['bn_id'].'" width="'.$size[0].'" alt="'.$row['bn_alt'].'"'.$bn_border.'>';
         if($banner)

diff --git a/theme/basic/skin/shop/basic/boxbanner.skin.php b/theme/basic/skin/shop/basic/boxbanner.skin.php
@@ -25,7 +25,7 @@
         if ($row['bn_url'][0] == '#')
             $banner .= '<a href="'.$row['bn_url'].'">';
         else if ($row['bn_url'] && $row['bn_url'] != 'http://') {
-            $banner .= '<a href="'.G5_SHOP_URL.'/bannerhit.php?bn_id='.$row['bn_id'].'&amp;url='.urlencode($row['bn_url']).'"'.$bn_new_win.'>';
+            $banner .= '<a href="'.G5_SHOP_URL.'/bannerhit.php?bn_id='.$row['bn_id'].'"'.$bn_new_win.'>';
         }
         echo $banner.'<img src="'.G5_DATA_URL.'/banner/'.$row['bn_id'].'" alt="'.$row['bn_alt'].'" width="'.$size[0].'" height="'.$size[1].'"'.$bn_border.'>';
         if($banner)

diff --git a/theme/basic/skin/shop/basic/mainbanner.10.skin.php b/theme/basic/skin/shop/basic/mainbanner.10.skin.php
@@ -37,7 +37,7 @@
         if ($row['bn_url'][0] == '#')
             $banner .= '<a href="'.$row['bn_url'].'">';
         else if ($row['bn_url'] && $row['bn_url'] != 'http://') {
-            $banner .= '<a href="'.G5_SHOP_URL.'/bannerhit.php?bn_id='.$row['bn_id'].'&amp;url='.urlencode($row['bn_url']).'"'.$bn_new_win.'>';
+            $banner .= '<a href="'.G5_SHOP_URL.'/bannerhit.php?bn_id='.$row['bn_id'].'"'.$bn_new_win.'>';
         }
         echo $banner.'<img src="'.G5_DATA_URL.'/banner/'.$row['bn_id'].'" width="'.$size[0].'" alt="'.$row['bn_alt'].'"'.$bn_border.'>';
         if($banner)