Vulnerabilities > CVE-2005-1236 - SQL Injection vulnerability in Duware Duportal 3.1.2/3.1.2Sql

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
duware
nessus
exploit available
NVD
Published: 2005-05-02
Updated: 2008-09-05

Summary

Multiple SQL injection vulnerabilities in DUware DUportal 3.1.2 and 3.1.2 SQL allow remote attackers to execute arbitrary SQL commands via the (1) iChannel parameter to channel.asp or search.asp, (2) iData parameter to detail.asp or inc_rating.asp, (3) iCat parameter to detail.asp or type.asp, (4) DAT_PARENT parameter to inc_poll_voting.asp, or (5) iRate parameter to inc_rating.asp, a different set of vulnerabilities than CVE-2005-1224.

Vulnerable Configurations

Part Description Count
Application
Duware
2

Exploit-Db

  • descriptionDUportal 3.1.2 type.asp iCat Parameter SQL Injection. CVE-2005-1236. Webapps exploit for asp platform
    idEDB-ID:25485
    last seen2016-02-03
    modified2005-04-20
    published2005-04-20
    reporterDcrab
    sourcehttps://www.exploit-db.com/download/25485/
    titleDUportal 3.1.2 type.asp iCat Parameter SQL Injection
  • descriptionDUportal 3.1.2 inc_poll_voting.asp DAT_PARENT Parameter SQL Injection. CVE-2005-1236. Webapps exploit for asp platform
    idEDB-ID:25483
    last seen2016-02-03
    modified2005-04-20
    published2005-04-20
    reporterDcrab
    sourcehttps://www.exploit-db.com/download/25483/
    titleDUportal 3.1.2 inc_poll_voting.asp DAT_PARENT Parameter SQL Injection
  • descriptionDUportal 3.1.2 inc_rating.asp Multiple Parameter SQL Injection. CVE-2005-1236. Webapps exploit for asp platform
    idEDB-ID:25484
    last seen2016-02-03
    modified2005-04-20
    published2005-04-20
    reporterDcrab
    sourcehttps://www.exploit-db.com/download/25484/
    titleDUportal 3.1.2 inc_rating.asp Multiple Parameter SQL Injection
  • descriptionDUportal 3.1.2 channel.asp iChannel Parameter SQL Injection. CVE-2005-1236 . Webapps exploit for asp platform
    idEDB-ID:25482
    last seen2016-02-03
    modified2005-04-20
    published2005-04-20
    reporterDcrab
    sourcehttps://www.exploit-db.com/download/25482/
    titleDUportal 3.1.2 channel.asp iChannel Parameter SQL Injection

Nessus

NASL familyCGI abuses
NASL idDUPORTAL_SQL_INJECTION.NASL
descriptionThe remote host is running DUPortal, a content management system written in ASP. The remote version of this software is vulnerable to several SQL injection vulnerabilities in files
last seen2020-06-01
modified2020-06-02
plugin id18120
published2005-04-22
reporterThis script is Copyright (C) 2005-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/18120
titleDUPortal/DUPortal Pro Multiple Scripts SQL Injection (1)

References