CVE-2005-2048 Multiple SQL injection vulnerabilities in DUware DUforum 3.1, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the (1) iMsg parameter to messages.asp, iFor par...
HighCVSS 7.5
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in DUware DUforum 3.1, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the (1) iMsg parameter to messages.asp, iFor parameter to (2) post.asp or (3) forums.asp, or (4) id parameter to userEdit.asp. NOTE: vectors 1 and 3 were later reported to affect version 3.0.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| duware duforum | = 3.1 | No fix listed |
References
- echo.or.id exploit vendor-advisory
- 20050622 [ECHO_ADV_19$2005] Multiple SQL INJECTION in DUWARE Products mailing-list
- 20061202 [Aria-Security Team] DuWare DuForum SQL Injection Vuln mailing-list
- duforum-messages-forums-sql-injection(30668) vdb-entry