CVE-2005-3976 SQL injection vulnerability in type.asp, as used in multiple DUware products including (1) DUamazon 3.1, (2) DUarticle 1.1, (3) DUclassified 4.2, (4) DUdirectory 3.1 and DUdirectory Pro 3.0 and 3.0 SQ...
HighCVSS 7.5
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in type.asp, as used in multiple DUware products including (1) DUamazon 3.1, (2) DUarticle 1.1, (3) DUclassified 4.2, (4) DUdirectory 3.1 and DUdirectory Pro 3.0 and 3.0 SQL, (5) DUdownload 1.1, (6) DUgallery 3.3, (7) DUnews 1.1, and (8) DUpaypal 3.1 and DUpaypal Pro 3.0, allows remote attackers to execute arbitrary SQL commands via the iType parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| duware duamazon | = 3.1 | No fix listed |
| duware duarticle | = 1.1 | No fix listed |
| duware duclassified | = 4.2 | No fix listed |
| duware dudirectory | = 3.1 | No fix listed |
| duware dudirectory pro | = 3.0 | No fix listed |
| duware dudirectory pro sql | = 3.0 | No fix listed |
| duware dudownload | = 1.1 | No fix listed |
| duware dugallery | = 3.3 | No fix listed |
| duware dunews | = 1.1 | No fix listed |
| duware dupaypal | = 3.1 | No fix listed |
| duware dupaypal pro | = 3.0 | No fix listed |
References
- 17835 third-party-advisory vendor-advisory
- 21385 vdb-entry
- 15681 vdb-entry
- ADV-2005-2700 vdb-entry
- dunews-type-detail-sql-injection(30673) vdb-entry