CVE:CVE-2010-3076
CNNVD:CNNVD-201010-222
Simple Management是一个管理框架。
基于BIND (又名smbind)的Simple Management 0.4.8之前版本中的php/src/include.php文件中的过滤函数不能锚特定的正则表达式。远程攻击者可以借助管理登陆页面的用户名参数进行SQL注入攻击并执行任意SQL命令。
solution:Upgrade blentz smbind to a higher version than 0.4.7,0.2,0.2.1,0.3.1,0.4,0.4.1,0.4.2,0.4.3,0.4.4,0.4.5,0.4.6,and avoid the version (,0.4.7],0.2,0.2.1,0.3.1,0.4,0.4.1,0.4.2,0.4.3,0.4.4,0.4.5,0.4.6