vulnwire
7.5high

CVE-2005-20484 exploits

Multiple SQL injection vulnerabilities in DUware DUforum 3.1, and possibly other versions, allow remote attackers to execute arbitrary SQL…

Published 21 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.4%
percentile 84%
Public exploits
4
Exploit-DB

Multiple SQL injection vulnerabilities in DUware DUforum 3.1, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the (1) iMsg parameter to messages.asp, iFor parameter to (2) post.asp or (3) forums.asp, or (4) id parameter to userEdit.asp. NOTE: vectors 1 and 3 were later reported to affect version 3.0.

Exploit prediction (EPSS)

2.44% probability of exploitation in the next 30 days, higher than 84% of all scored CVEs.

Exploits and detections

  • EDB-25871 DUware DUforum 3.0/3.1 - 'userEdit.asp?id' SQL Injection · webapps · 2005-06-22
  • EDB-25870 DUware DUforum 3.0/3.1 - 'forums.asp?iFor' SQL Injection · webapps · 2005-06-22
  • EDB-25869 DUware DUforum 3.0/3.1 - 'post.asp?iFor' SQL Injection · webapps · 2005-06-22
  • EDB-25868 DUware DUforum 3.0/3.1 - 'messages.asp?iMsg' SQL Injection · webapps · 2005-06-22

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

References

  • marc.info /?l=bugtraq&m=111945219205114&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • securityfocus.com /archive/1/453330/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/30668 · vdb-entry, x_refsource_XF, x_transferred
  • echo.or.id /adv/adv19-theday-2005.txt · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.