CVE-2005-12246 exploits
Multiple SQL injection vulnerabilities in DUware DUportal Pro 3.4 allow remote attackers to execute arbitrary SQL commands via the (1) nCha…
Published 21 y ago · modified 4 mo ago · JSON
Summary
Multiple SQL injection vulnerabilities in DUware DUportal Pro 3.4 allow remote attackers to execute arbitrary SQL commands via the (1) nChannel parameter to default.asp, cat.asp, or detail.asp, (2) the iChannel parameter to search.asp, default.asp, result.asp, cat.asp, or detail.asp (3) the iCat parameter to cat.asp or detail.asp, (4) the iData parameter to detail.asp or result.asp, the (5) POL_ID, (6) POL_PARENT, (7) POL_CATEGORY, (8) CHA_NAME, or (9) CHA_ID parameters to inc_vote.asp, or the (10) tfm_order or (11) tfm_orderby parameters to toppages.asp, a different set of vulnerabilities than CVE-2005-1236.
Exploit prediction (EPSS)
3.65% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.
Exploits and detections
- EDB-25481 DUportal Pro 3.4 - 'detail.asp' Multiple SQL Injections · webapps · 2005-04-20
- EDB-25480 DUportal Pro 3.4 - 'cat.asp' Multiple SQL Injections · webapps · 2005-04-20
- EDB-25479 DUportal Pro 3.4 - 'result.asp' Multiple SQL Injections · webapps · 2005-04-20
- EDB-25478 DUportal Pro 3.4 - 'inc_vote.asp' Multiple SQL Injections · webapps · 2005-04-20
- EDB-25477 DUportal Pro 3.4 - 'search.asp?iChannel' SQL Injection · webapps · 2005-04-20
- EDB-25476 DUportal Pro 3.4 - 'default.asp' Multiple SQL Injections · webapps · 2005-04-20
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
- securityfocus.com /bid/13285 · vdb-entry, x_refsource_BID, x_transferred
- securiteam.com /windowsntfocus/5TP0O0AFFQ.html · x_refsource_MISC, x_transferred
- securityfocus.com /archive/1/453316/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
- digitalparadox.org /advisories/duppro.txt · x_refsource_MISC, x_transferred
- marc.info /?l=bugtraq&m=111401172901705&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/20197 · vdb-entry, x_refsource_XF, x_transferred
- secunia.com /advisories/15031 · third-party-advisory, x_refsource_SECUNIA, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/30671 · vdb-entry, x_refsource_XF, x_transferred
Sources
- CVE List: CVE-2005-1224
- NVD: CVE-2005-1224
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.