Barracuda Spam Firewall v3.5.11.020, Model 600 SQL Injection Vuln（情報元のブックマーク数）
BarracudaのSpamFireWallにSQLインジェクションの脆弱性が存在するそうです。
Barracuda Networks Spam Firewall is vulnerable to various SQL Injection attacks. When exploited by an authenticated user, the identified vulnerability can lead to Denial of Service, Database Information Disclosure, etc.
http://www.milw0rm.com/exploits/7496
管理画面に脆弱性なのかな？
The index.cgi resource was identified as being susceptible to SQL Injection attacks.
When filtering user accounts in Users->Account View section, the pattern_x parameter
(where x = 0..n) allows inserting arbitrary SQL code once filter_x parameter is set
to search_count_equals‘ value./cgi-bin/index.cgi?&user=&password=&et=&auth_type=Local&locale=en_US&realm=&primary_tab=USERS&secondary_tab=per_user_account_view&boolean_0=boolean_and&filter_0=search_count_equals&pattern_0=if(database() like concat(char(99),char(37)),5,0)
An attacker can exploit this vulnerability by injecting arbitrary SQL code to be
http://www.milw0rm.com/exploits/7496
executed as part of the SQL query.
