CVE-2007-10001 (published 2023-01-05T12:15Z)

A vulnerability classified as problematic has been found in web-cyradm. This affects an unknown part of the file search.php. The manipulation of the argument searchstring leads to sql injection. It is recommended to apply a patch to fix this issue. The identifier VDB-217449 was assigned to this vulnerability.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/web-cyradm/web-cyradm
commit_details: repo_url: https://github.com/web-cyradm/web-cyradm
author: luc
author_date: 2007-07-01 07:53:16+00:00
msg: Fixed information disclosure by SQL injection
repository: repo_url: https://github.com/web-cyradm/web-cyradm
repo_name: web-cyradm/web-cyradm
description: Web-cyradm is a web based software that glues topnotch mailing technologies like cyrus-imap and postfix together.
repo_language: PHP
owner: web-cyradm
file_changes: filename: search.php
change_type: ModificationType.MODIFY
diff: @@ -34,7 +34,7 @@ if ($authorized) {
 
 
 	#####  Show matching Domains first #######
-	$query = "SELECT * FROM domain AS a WHERE domain_name LIKE '%".$_GET['searchstring']."%' AND ".$allowed_domains1."') ORDER BY domain_name";
+	$query = "SELECT * FROM domain AS a WHERE domain_name LIKE '%".addslashes($_GET['searchstring'])."%' AND ".$allowed_domains1."') ORDER BY domain_name";
 	$result = $handle->query($query);
 	$cnt = $result->numRows();
 
@@ -105,7 +105,7 @@ if ($authorized) {
 	print "</table>";
 
 	############ And now show the users matching the search query ###########
-	$query = "SELECT DISTINCT a.username, a.domain_name FROM virtual as v, accountuser as a WHERE ((v.username LIKE '%".$_GET['searchstring']."%') OR (v.alias LIKE '%".$_GET['searchstring']."%')) AND (v.username=a.username) AND ".$allowed_domains1."') ORDER BY username";
+	$query = "SELECT DISTINCT a.username, a.domain_name FROM virtual as v, accountuser as a WHERE ((v.username LIKE '%".addslashes($_GET['searchstring'])."%') OR (v.alias LIKE '%".addslashes($_GET['searchstring'])."%')) AND (v.username=a.username) AND ".$allowed_domains1."') ORDER BY username";
 	$result = $handle->query($query);
 	$total = $result->numRows();
 
@@ -113,7 +113,7 @@ if ($authorized) {
 	if (empty($row_pos)) {
 		$row_pos = 0;
 	}
-        $query = "SELECT DISTINCT a.* FROM virtual as v, accountuser as a WHERE ((v.username LIKE '%".$_GET['searchstring']."%') OR (v.alias LIKE '%".$_GET['searchstring']."%')) AND (v.username=a.username) AND ".$allowed_domains1."') ORDER BY username";
+        $query = "SELECT DISTINCT a.* FROM virtual as v, accountuser as a WHERE ((v.username LIKE '%".$_GET['searchstring']."%') OR (v.alias LIKE '%".addslashes($_GET['searchstring'])."%')) AND (v.username=a.username) AND ".$allowed_domains1."') ORDER BY username";
 	$result = $handle->limitQuery($query,$row_pos,10);
 	$cnt = $result->numRows();
 

programming_language: PHP