CVE-2010-3076

EUVD-2010-3078
The filter function in php/src/include.php in Simple Management for BIND (aka smbind) before 0.4.8 does not anchor a certain regular expression, which allows remote attackers to conduct SQL injection attacks and execute arbitrary SQL commands via the username parameter to the admin login page.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 62%
Affected Products (NVD)
VendorProductVersion
blentzsmbind
𝑥
≤ 0.4.7
blentzsmbind
0.2
blentzsmbind
0.2.1
blentzsmbind
0.3.1
blentzsmbind
0.4
blentzsmbind
0.4.1
blentzsmbind
0.4.2
blentzsmbind
0.4.3
blentzsmbind
0.4.4
blentzsmbind
0.4.5
blentzsmbind
0.4.6
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
smbind
dapper
dne
hardy
dne
jaunty
ignored
karmic
ignored
lucid
Fixed 0.4.7-3+lenny1build0.10.04.1
released
maverick
ignored
natty
not-affected
oneiric
not-affected
Common Weakness Enumeration
References
http://packetstormsecurity.org/1009-exploits/smbind-sql.txt
http://sourceforge.net/projects/smbind/files/smbind/0.4.8/smbind-0.4.8.tar.bz2/download
http://www.debian.org/security/2010/dsa-2103
http://www.openwall.com/lists/oss-security/2010/09/05/5
http://www.openwall.com/lists/oss-security/2010/09/07/10
http://packetstormsecurity.org/1009-exploits/smbind-sql.txt
http://sourceforge.net/projects/smbind/files/smbind/0.4.8/smbind-0.4.8.tar.bz2/download
http://www.debian.org/security/2010/dsa-2103
http://www.openwall.com/lists/oss-security/2010/09/05/5
http://www.openwall.com/lists/oss-security/2010/09/07/10