CVE-2018-10757: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: CSP MySQL User Manager 2.3.1 allows SQL injection, and resultant Authentication Bypass, via a crafted username during a login attempt.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2018-05-05T19:29Z
Repository: https://github.com/dukereborn/cmum
Language: JavaScript
Files changed: CHANGELOG, js/ajaxcalls.js, js/cmum.js
Commit date: 2015-04-26 11:40:24 +0200
Commit message: Check for invalid characters in username and password

Diff: diff --git a/CHANGELOG b/CHANGELOG
index fc8ba78..a1db94f 100755
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,10 +7,11 @@ CSP MySQL User Manager Changelog
 
 
 3.2.0 [not yet released]
 [+] Enable/disable groups
 [+] Override and force database upgrade
+[+] Check for invalid characters in username and password
 [#] Changed update check url for new releases
 [#] Removed cmum dbversion from database
 
 
 3.1.1 [2015-04-12]
diff --git a/js/ajaxcalls.js b/js/ajaxcalls.js
index e162405..49e36c3 100755
--- a/js/ajaxcalls.js
+++ b/js/ajaxcalls.js
@@ -6,10 +6,18 @@ function checkusername() {
 				if(username=="") {
 					newuser.user.focus();
 				} else if(password=="") {
 					newuser.password.focus();
 				}
+		} else if(alphanumeric(username)==false || alphanumeric(password)==false) {
+			if(alphanumeric(username)==false) {
+				toastr.error('Username contains invalid characters');
+				newuser.user.focus();
+			} else if(alphanumeric(password)==false) {
+				toastr.error('Password contains invalid characters');
+				newuser.password.focus();
+			}
 		} else {
 			jQuery.ajax({
 				type: 'post',
 				url: 'functions/ajaxhelper.php',
 				data: 'function=1&username='+username,
@@ -36,10 +44,18 @@ function checkeditusername() {
 					edituser.password.focus();
 				}
 				if(username=="") {
 					edituser.user.focus();
 				}
+		} else if(alphanumeric(username)==false || alphanumeric(password)==false) {
+			if(alphanumeric(username)==false) {
+				toastr.error('Username contains invalid characters');
+				newuser.user.focus();
+			} else if(alphanumeric(password)==false) {
+				toastr.error('Password contains invalid characters');
+				newuser.password.focus();
+			}
 		} else {
 			if(username!=rusername) {
 				jQuery.ajax({
 					type: 'post',
 					url: 'functions/ajaxhelper.php',
diff --git a/js/cmum.js b/js/cmum.js
index 01836ff..d416400 100755
--- a/js/cmum.js
+++ b/js/cmum.js
@@ -52,6 +52,15 @@ function checksearch(e) {
 				newsearch.searchfor.focus();
 			} else {
 				$('#newsearch').trigger('submit', true);
 			}
 	}
+}
+
+function alphanumeric(inputtxt) { 
+	var letters = /^[0-9a-zA-Z]+$/;
+		if (letters.test(inputtxt)) {
+			return true;
+		} else {
+			return false;
+		}
 }
\ No newline at end of file

Fixed code: [+] Check for invalid characters in username and password
		} else if(alphanumeric(username)==false || alphanumeric(password)==false) {
			if(alphanumeric(username)==false) {
				toastr.error('Username contains invalid characters');
				newuser.user.focus();
			} else if(alphanumeric(password)==false) {
				toastr.error('Password contains invalid characters');
				newuser.password.focus();
			}
		} else if(alphanumeric(username)==false || alphanumeric(password)==false) {
			if(alphanumeric(username)==false) {
				toastr.error('Username contains invalid characters');
				newuser.user.focus();
			} else if(alphanumeric(password)==false) {
				toastr.error('Password contains invalid characters');
				newuser.password.focus();
			}
}

function alphanumeric(inputtxt) { 
	var letters = /^[0-9a-zA-Z]+$/;
		if (letters.test(inputtxt)) {
			return true;
		} else {
			return false;
		}