CVE-2006-6367 Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) iFile or (2) action parameter....
HighCVSS 7.5
EPSS 1.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) iFile or (2) action parameter. NOTE: the iType parameter is already covered by CVE-2005-3976.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| duware dudownload | = 1.0 | No fix listed |
| duware dudownload | = 1.1 | No fix listed |
| duware dunews | = 1.0 | No fix listed |
| duware dunews | = 1.1 | No fix listed |
| duware dupaypal | = 3.0 | No fix listed |
| duware dupaypal | = 3.1 | No fix listed |
| duware dupaypal | = pro_3.0 | No fix listed |
| duware dupaypal | = pro_3.1 | No fix listed |
References
- 20061202 [Aria-Security Team] DuWare DuDownloads SQL Injection Vuln mailing-list
- 23224 third-party-advisory vendor-advisory
- www.aria-security.com broken-link
- 21405 exploit third-party-advisory vdb-entry
- ADV-2006-4845 not-applicable vdb-entry
- dudownload-type-sql-injection(30669) vdb-entry