Vulnerabilities > CVE-2005-1224 - SQL Injection vulnerability in Duware Duportal 3.4/Pro3.4/Sql3.4

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
duware
nessus
exploit available
NVD
Published: 2005-05-02
Updated: 2018-10-19

Summary

Multiple SQL injection vulnerabilities in DUware DUportal Pro 3.4 allow remote attackers to execute arbitrary SQL commands via the (1) nChannel parameter to default.asp, cat.asp, or detail.asp, (2) the iChannel parameter to search.asp, default.asp, result.asp, cat.asp, or detail.asp (3) the iCat parameter to cat.asp or detail.asp, (4) the iData parameter to detail.asp or result.asp, the (5) POL_ID, (6) POL_PARENT, (7) POL_CATEGORY, (8) CHA_NAME, or (9) CHA_ID parameters to inc_vote.asp, or the (10) tfm_order or (11) tfm_orderby parameters to toppages.asp, a different set of vulnerabilities than CVE-2005-1236.

Vulnerable Configurations

Part Description Count
Application
Duware
3

Exploit-Db

  • descriptionDUportal Pro 3.4 inc_vote.asp Multiple Parameter SQL Injection. CVE-2005-1224. Webapps exploit for asp platform
    idEDB-ID:25478
    last seen2016-02-03
    modified2005-04-20
    published2005-04-20
    reporterDcrab
    sourcehttps://www.exploit-db.com/download/25478/
    titleDUportal Pro 3.4 inc_vote.asp Multiple Parameter SQL Injection
  • descriptionDUportal Pro 3.4 result.asp Multiple Parameter SQL Injection. CVE-2005-1224. Webapps exploit for asp platform
    idEDB-ID:25479
    last seen2016-02-03
    modified2005-04-20
    published2005-04-20
    reporterDcrab
    sourcehttps://www.exploit-db.com/download/25479/
    titleDUportal Pro 3.4 result.asp Multiple Parameter SQL Injection
  • descriptionDUportal Pro 3.4 search.asp iChannel Parameter SQL Injection. CVE-2005-1224. Webapps exploit for asp platform
    idEDB-ID:25477
    last seen2016-02-03
    modified2005-04-20
    published2005-04-20
    reporterDcrab
    sourcehttps://www.exploit-db.com/download/25477/
    titleDUportal Pro 3.4 - search.asp iChannel Parameter SQL Injection
  • descriptionDUportal Pro 3.4 default.asp Multiple Parameter SQL Injection. CVE-2005-1224 . Webapps exploit for asp platform
    idEDB-ID:25476
    last seen2016-02-03
    modified2005-04-20
    published2005-04-20
    reporterDcrab
    sourcehttps://www.exploit-db.com/download/25476/
    titleDUportal Pro 3.4 default.asp Multiple Parameter SQL Injection
  • descriptionDUportal Pro 3.4 cat.asp Multiple Parameter SQL Injection. CVE-2005-1224. Webapps exploit for asp platform
    idEDB-ID:25480
    last seen2016-02-03
    modified2005-04-20
    published2005-04-20
    reporterDcrab
    sourcehttps://www.exploit-db.com/download/25480/
    titleDUportal Pro 3.4 cat.asp Multiple Parameter SQL Injection
  • descriptionDUportal Pro 3.4 detail.asp Multiple Parameter SQL Injection. CVE-2005-1224 . Webapps exploit for asp platform
    idEDB-ID:25481
    last seen2016-02-03
    modified2005-04-20
    published2005-04-20
    reporterDcrab
    sourcehttps://www.exploit-db.com/download/25481/
    titleDUportal Pro 3.4 detail.asp Multiple Parameter SQL Injection

Nessus

NASL familyCGI abuses
NASL idDUPORTAL_SQL_INJECTION.NASL
descriptionThe remote host is running DUPortal, a content management system written in ASP. The remote version of this software is vulnerable to several SQL injection vulnerabilities in files
last seen2020-06-01
modified2020-06-02
plugin id18120
published2005-04-22
reporterThis script is Copyright (C) 2005-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/18120
titleDUPortal/DUPortal Pro Multiple Scripts SQL Injection (1)

References