Back to feed
EUVD-2010-3078 · Published Oct 14, 2010
The filter function in php/src/include.php in Simple Management for BIND (aka smbind) before 0.4.8 does not anchor a certain regular expression, which allows remote attackers to conduct SQL injection attacks and execute arbitrary SQL commands via the username parameter to the admin login page.
Technologies
Blentz Smbind
Weaknesses
CWE-89
CVSS scores
- v2.07.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
- http://packetstormsecurity.org/1009-exploits/smbind-sql.txt
- http://sourceforge.net/projects/smbind/files/smbind/0.4.8/smbind-0.4.8.tar.bz2/download
- http://www.debian.org/security/2010/dsa-2103
- http://www.openwall.com/lists/oss-security/2010/09/05/5
- http://www.openwall.com/lists/oss-security/2010/09/07/10
Potentially impacted assets
See if this affects your attack surface
