CVE-2018-15585: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-Site Scripting (XSS) vulnerability in newwinform.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-03-27T20:29Z
Repository: https://github.com/gnuboard/gnuboard5
Language: PHP
Files changed: adm/boardgroup_form.php, adm/boardgroup_form_update.php, adm/boardgroup_list_update.php, adm/contentform.php, adm/contentformupdate.php, adm/faqmasterform.php, adm/faqmasterformupdate.php, adm/newwinform.php, adm/newwinformupdate.php, adm/point_update.php, adm/sms_admin/num_book_update.php, adm/sms_admin/num_book_write.php
Commit date: 2018-08-22 14:02:14 +0900
Commit message: XSS 취약점 수정

Diff: diff --git a/adm/boardgroup_form.php b/adm/boardgroup_form.php
index df2b9b2..73e162d 100644
--- a/adm/boardgroup_form.php
+++ b/adm/boardgroup_form.php
@@ -10,11 +10,11 @@ $html_title = '게시판그룹';
 $gr_id_attr = '';
 $sound_only = '';
 if ($w == '') {
     $gr_id_attr = 'required';
     $sound_only = '<strong class="sound_only"> 필수</strong>';
-    $gr['gr_use_access'] = 0;
+    $gr = array('gr_use_access' => 0);
     $html_title .= ' 생성';
 } else if ($w == 'u') {
     $gr_id_attr = 'readonly';
     $gr = sql_fetch(" select * from {$g5['group_table']} where gr_id = '$gr_id' ");
     $html_title .= ' 수정';
diff --git a/adm/boardgroup_form_update.php b/adm/boardgroup_form_update.php
index c29558f..7ce694a 100644
--- a/adm/boardgroup_form_update.php
+++ b/adm/boardgroup_form_update.php
@@ -14,11 +14,13 @@ check_admin_token();
 if (!preg_match("/^([A-Za-z0-9_]{1,10})$/", $_POST['gr_id']))
     alert('그룹 ID는 공백없이 영문자, 숫자, _ 만 사용 가능합니다. (10자 이내)');
 
 if (!$gr_subject) alert('그룹 제목을 입력하세요.');
 
-$sql_common = " gr_subject = '{$_POST['gr_subject']}',
+$gr_subject = isset($_POST['gr_subject']) ? strip_tags($_POST['gr_subject']) : '';
+
+$sql_common = " gr_subject = '{$gr_subject}',
                 gr_device = '{$_POST['gr_device']}',
                 gr_admin  = '{$_POST['gr_admin']}',
                 gr_1_subj = '{$_POST['gr_1_subj']}',
                 gr_2_subj = '{$_POST['gr_2_subj']}',
                 gr_3_subj = '{$_POST['gr_3_subj']}',
diff --git a/adm/boardgroup_list_update.php b/adm/boardgroup_list_update.php
index c10cd24..fbf9e2f 100644
--- a/adm/boardgroup_list_update.php
+++ b/adm/boardgroup_list_update.php
@@ -17,14 +17,15 @@ if(!$count)
 
 for ($i=0; $i<$count; $i++)
 {
     $k     = $_POST['chk'][$i];
     $gr_id = $_POST['group_id'][$k];
+    $gr_subject = strip_tags($_POST['gr_subject'][$k]);
 
     if($_POST['act_button'] == '선택수정') {
         $sql = " update {$g5['group_table']}
-                    set gr_subject    = '{$_POST['gr_subject'][$k]}',
+                    set gr_subject    = '{$gr_subject}',
                         gr_device     = '{$_POST['gr_device'][$k]}',
                         gr_admin      = '{$_POST['gr_admin'][$k]}',
                         gr_use_access = '{$_POST['gr_use_access'][$k]}',
                         gr_order      = '{$_POST['gr_order'][$k]}'
                   where gr_id         = '{$gr_id}' ";
diff --git a/adm/contentform.php b/adm/contentform.php
index 024a176..7ebe8bf 100644
--- a/adm/contentform.php
+++ b/adm/contentform.php
@@ -47,13 +47,15 @@ if ($w == "u")
         alert('등록된 자료가 없습니다.');
 }
 else
 {
     $html_title .= ' 입력';
-    $co['co_html'] = 2;
-    $co['co_skin'] = 'basic';
-    $co['co_mobile_skin'] = 'basic';
+    $co = array(
+        'co_html' => 2,
+        'co_skin' => 'basic',
+        'co_mobile_skin' => 'basic'
+        );
 }
 
 include_once (G5_ADMIN_PATH.'/admin.head.php');
 ?>
 
diff --git a/adm/contentformupdate.php b/adm/contentformupdate.php
index d344c47..dff780a 100644
--- a/adm/contentformupdate.php
+++ b/adm/contentformupdate.php
@@ -18,10 +18,11 @@ if ($w == "" || $w == "u")
 
     $sql = " select * from {$g5['content_table']} where co_id = '$co_id' ";
     $co_row = sql_fetch($sql);
 }
 
+$co_subject = strip_tags($co_subject);
 $co_include_head = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($co_include_head, 0, 255));
 $co_include_tail = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($co_include_tail, 0, 255));
 
 // 관리자가 자동등록방지를 사용해야 할 경우
 if (($co_row['co_include_head'] !== $co_include_head || $co_row['co_include_tail'] !== $co_include_tail) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()){
diff --git a/adm/faqmasterform.php b/adm/faqmasterform.php
index df87fec..d48f69e 100644
--- a/adm/faqmasterform.php
+++ b/adm/faqmasterform.php
@@ -19,10 +19,11 @@ if ($w == "u")
     if (!$fm['fm_id']) alert('등록된 자료가 없습니다.');
 }
 else
 {
     $html_title .= ' 입력';
+    $fm = array();
 }
 
 $g5['title'] = $html_title.' 관리';
 
 // 모바일 상하단 내용 필드추가
diff --git a/adm/faqmasterformupdate.php b/adm/faqmasterformupdate.php
index fed67d6..f753683 100644
--- a/adm/faqmasterformupdate.php
+++ b/adm/faqmasterformupdate.php
@@ -16,10 +16,12 @@ check_admin_token();
 @chmod(G5_DATA_PATH."/faq", G5_DIR_PERMISSION);
 
 if ($fm_himg_del)  @unlink(G5_DATA_PATH."/faq/{$fm_id}_h");
 if ($fm_timg_del)  @unlink(G5_DATA_PATH."/faq/{$fm_id}_t");
 
+$fm_subject = strip_tags($fm_subject);
+
 $sql_common = " set fm_subject = '$fm_subject',
                     fm_head_html = '$fm_head_html',
                     fm_tail_html = '$fm_tail_html',
                     fm_mobile_head_html = '$fm_mobile_head_html',
                     fm_mobile_tail_html = '$fm_mobile_tail_html',
diff --git a/adm/newwinform.php b/adm/newwinform.php
index 1e64f41..10aab22 100644
--- a/adm/newwinform.php
+++ b/adm/newwinform.php
@@ -107,11 +107,11 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
         </td>
     </tr>
     <tr>
         <th scope="row"><label for="nw_subject">팝업 제목<strong class="sound_only"> 필수</strong></label></th>
         <td>
-            <input type="text" name="nw_subject" value="<?php echo stripslashes($nw['nw_subject']) ?>" id="nw_subject" required class="frm_input required" size="80">
+            <input type="text" name="nw_subject" value="<?php echo get_sanitize_input($nw['nw_subject']); ?>" id="nw_subject" required class="frm_input required" size="80">
         </td>
     </tr>
     <tr>
         <th scope="row"><label for="nw_content">내용</label></th>
         <td><?php echo editor_html('nw_content', get_text($nw['nw_content'], 0)); ?></td>
diff --git a/adm/newwinformupdate.php b/adm/newwinformupdate.php
index 191e54a..1441ac8 100644
--- a/adm/newwinformupdate.php
+++ b/adm/newwinformupdate.php
@@ -10,19 +10,21 @@ if ($w == 'd')
 else
     auth_check($auth[$sub_menu], "w");
 
 check_admin_token();
 
+$nw_subject = isset($_POST['nw_subject']) ? strip_tags($_POST['nw_subject']) : '';
+
 $sql_common = " nw_device = '{$_POST['nw_device']}',
                 nw_begin_time = '{$_POST['nw_begin_time']}',
                 nw_end_time = '{$_POST['nw_end_time']}',
                 nw_disable_hours = '{$_POST['nw_disable_hours']}',
                 nw_left = '{$_POST['nw_left']}',
                 nw_top = '{$_POST['nw_top']}',
                 nw_height = '{$_POST['nw_height']}',
                 nw_width = '{$_POST['nw_width']}',
-                nw_subject = '{$_POST['nw_subject']}',
+                nw_subject = '{$nw_subject}',
                 nw_content = '{$_POST['nw_content']}',
                 nw_content_html = '{$_POST['nw_content_html']}' ";
 
 if($w == "")
 {
diff --git a/adm/point_update.php b/adm/point_update.php
index 2240e60..571a1df 100644
--- a/adm/point_update.php
+++ b/adm/point_update.php
@@ -4,13 +4,13 @@ include_once('./_common.php');
 
 auth_check($auth[$sub_menu], 'w');
 
 check_admin_token();
 
-$mb_id = $_POST['mb_id'];
-$po_point = $_POST['po_point'];
-$po_content = $_POST['po_content'];
+$mb_id = strip_tags($_POST['mb_id']);
+$po_point = strip_tags($_POST['po_point']);
+$po_content = strip_tags($_POST['po_content']);
 $expire = preg_replace('/[^0-9]/', '', $_POST['po_expire_term']);
 
 $mb = get_member($mb_id);
 
 if (!$mb['mb_id'])
diff --git a/adm/sms_admin/num_book_update.php b/adm/sms_admin/num_book_update.php
index 578c482..0a13c64 100644
--- a/adm/sms_admin/num_book_update.php
+++ b/adm/sms_admin/num_book_update.php
@@ -19,10 +19,12 @@ if ($w=='u') // 업데이트
     if (!$bk_receipt) $bk_receipt = 0; else $bk_receipt = 1;
 
     if (!strlen(trim($bk_name)))
         alert('이름을 입력해주세요');
 
+    $bk_name = strip_tags($bk_name);
+
     if ($bk_hp == '')
         alert('휴대폰번호만 입력 가능합니다.');
 /*
     $res = sql_fetch("select * from {$g5['sms5_book_table']} where bk_no<>'$bk_no' and bk_hp='$bk_hp'");
     if ($res)
diff --git a/adm/sms_admin/num_book_write.php b/adm/sms_admin/num_book_write.php
index 2e05a4b..06896f8 100644
--- a/adm/sms_admin/num_book_write.php
+++ b/adm/sms_admin/num_book_write.php
@@ -28,11 +28,11 @@ if ($w == 'u' && is_numeric($bk_no)) {
         $exist_msg = count($exist_hplist) ? $exist_msg_1 : $exist_msg_2;
     }
     $g5['title'] .= '수정';
 }
 else  {
-    $write['bg_no'] = $bg_no;
+    $write = array('bg_no' => (int) $bg_no);
     $g5['title'] .= '추가';
 }
 
 if (!is_numeric($write['bk_receipt']))
     $write['bk_receipt'] = 1;
@@ -72,11 +72,11 @@ include_once(G5_ADMIN_PATH."/admin.head.php");
             </select>
         </td>
     </tr>
     <tr>
         <th scope="row"><label for="bk_name">이름<strong class="sound_only"> 필수</strong></label></th>
-        <td><input type="text" name="bk_name" id="bk_name" maxlength="50" value="<?php echo $write['bk_name']?>" required class="frm_input required"></td>
+        <td><input type="text" name="bk_name" id="bk_name" maxlength="50" value="<?php echo get_sanitize_input($write['bk_name']); ?>" required class="frm_input required"></td>
     </tr>
     <tr>
         <th scope="row"><label for="bk_hp">휴대폰번호<strong class="sound_only"> 필수</strong></label></th>
         <td>
             <input type="text" name="bk_hp" id="bk_hp" value="<?php echo $write['bk_hp']?>" required class="frm_input required">

Vulnerable code:     $gr['gr_use_access'] = 0;
$sql_common = " gr_subject = '{$_POST['gr_subject']}',
                    set gr_subject    = '{$_POST['gr_subject'][$k]}',
    $co['co_html'] = 2;
    $co['co_skin'] = 'basic';
    $co['co_mobile_skin'] = 'basic';
            <input type="text" name="nw_subject" value="<?php echo stripslashes($nw['nw_subject']) ?>" id="nw_subject" required class="frm_input required" size="80">
                nw_subject = '{$_POST['nw_subject']}',
$mb_id = $_POST['mb_id'];
$po_point = $_POST['po_point'];
$po_content = $_POST['po_content'];
    $write['bg_no'] = $bg_no;
        <td><input type="text" name="bk_name" id="bk_name" maxlength="50" value="<?php echo $write['bk_name']?>" required class="frm_input required"></td>
Fixed code:     $gr = array('gr_use_access' => 0);
$gr_subject = isset($_POST['gr_subject']) ? strip_tags($_POST['gr_subject']) : '';

$sql_common = " gr_subject = '{$gr_subject}',
    $gr_subject = strip_tags($_POST['gr_subject'][$k]);
                    set gr_subject    = '{$gr_subject}',
    $co = array(
        'co_html' => 2,
        'co_skin' => 'basic',
        'co_mobile_skin' => 'basic'
        );
$co_subject = strip_tags($co_subject);
    $fm = array();
$fm_subject = strip_tags($fm_subject);

            <input type="text" name="nw_subject" value="<?php echo get_sanitize_input($nw['nw_subject']); ?>" id="nw_subject" required class="frm_input required" size="80">
$nw_subject = isset($_POST['nw_subject']) ? strip_tags($_POST['nw_subject']) : '';

                nw_subject = '{$nw_subject}',
$mb_id = strip_tags($_POST['mb_id']);
$po_point = strip_tags($_POST['po_point']);
$po_content = strip_tags($_POST['po_content']);
    $bk_name = strip_tags($bk_name);

    $write = array('bg_no' => (int) $bg_no);
        <td><input type="text" name="bk_name" id="bk_name" maxlength="50" value="<?php echo get_sanitize_input($write['bk_name']); ?>" required class="frm_input required"></td>