CVE-2010-3076

The filter function in php/src/include.php in Simple Management for BIND (aka smbind) before 0.4.8 does not anchor a certain regular expression, which allows remote attackers to conduct SQL injection attacks and execute arbitrary SQL commands via the username parameter to the admin login page.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 62%
VendorProductVersion
blentzsmbind
𝑥
≤ 0.4.7
blentzsmbind
0.2
blentzsmbind
0.2.1
blentzsmbind
0.3.1
blentzsmbind
0.4
blentzsmbind
0.4.1
blentzsmbind
0.4.2
blentzsmbind
0.4.3
blentzsmbind
0.4.4
blentzsmbind
0.4.5
blentzsmbind
0.4.6
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
smbind
oneiric
not-affected
natty
not-affected
maverick
ignored
lucid
Fixed 0.4.7-3+lenny1build0.10.04.1
released
karmic
ignored
jaunty
ignored
hardy
dne
dapper
dne
Common Weakness Enumeration
References
http://packetstormsecurity.org/1009-exploits/smbind-sql.txt
http://sourceforge.net/projects/smbind/files/smbind/0.4.8/smbind-0.4.8.tar.bz2/download
http://www.debian.org/security/2010/dsa-2103
http://www.openwall.com/lists/oss-security/2010/09/05/5
http://www.openwall.com/lists/oss-security/2010/09/07/10
http://packetstormsecurity.org/1009-exploits/smbind-sql.txt
http://sourceforge.net/projects/smbind/files/smbind/0.4.8/smbind-0.4.8.tar.bz2/download
http://www.debian.org/security/2010/dsa-2103
http://www.openwall.com/lists/oss-security/2010/09/05/5
http://www.openwall.com/lists/oss-security/2010/09/07/10