CVE-2018-10757 (published 2018-05-05T19:29Z)

CSP MySQL User Manager 2.3.1 allows SQL injection, and resultant Authentication Bypass, via a crafted username during a login attempt.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/dukereborn/cmum
commit_details: repo_url: https://github.com/dukereborn/cmum
author: DukeReborn
author_date: 2015-04-26 11:40:24+02:00
msg: Check for invalid characters in username and password
repository: repo_url: https://github.com/dukereborn/cmum
repo_name: dukereborn/cmum
description: CSP MySQL User Manager
repo_language: PHP
owner: dukereborn
file_changes: filename: CHANGELOG
change_type: ModificationType.MODIFY
diff: @@ -9,6 +9,7 @@ CSP MySQL User Manager Changelog
 3.2.0 [not yet released]
 [+] Enable/disable groups
 [+] Override and force database upgrade
+[+] Check for invalid characters in username and password
 [#] Changed update check url for new releases
 [#] Removed cmum dbversion from database
 

programming_language: Markdown
filename: ajaxcalls.js
change_type: ModificationType.MODIFY
diff: @@ -8,6 +8,14 @@ function checkusername() {
 				} else if(password=="") {
 					newuser.password.focus();
 				}
+		} else if(alphanumeric(username)==false || alphanumeric(password)==false) {
+			if(alphanumeric(username)==false) {
+				toastr.error('Username contains invalid characters');
+				newuser.user.focus();
+			} else if(alphanumeric(password)==false) {
+				toastr.error('Password contains invalid characters');
+				newuser.password.focus();
+			}
 		} else {
 			jQuery.ajax({
 				type: 'post',
@@ -38,6 +46,14 @@ function checkeditusername() {
 				if(username=="") {
 					edituser.user.focus();
 				}
+		} else if(alphanumeric(username)==false || alphanumeric(password)==false) {
+			if(alphanumeric(username)==false) {
+				toastr.error('Username contains invalid characters');
+				newuser.user.focus();
+			} else if(alphanumeric(password)==false) {
+				toastr.error('Password contains invalid characters');
+				newuser.password.focus();
+			}
 		} else {
 			if(username!=rusername) {
 				jQuery.ajax({

programming_language: JavaScript
filename: cmum.js
change_type: ModificationType.MODIFY
diff: @@ -54,4 +54,13 @@ function checksearch(e) {
 				$('#newsearch').trigger('submit', true);
 			}
 	}
+}
+
+function alphanumeric(inputtxt) { 
+	var letters = /^[0-9a-zA-Z]+$/;
+		if (letters.test(inputtxt)) {
+			return true;
+		} else {
+			return false;
+		}
 }
\ No newline at end of file

programming_language: JavaScript