CVE-2005-2045
Multiple SQL injection vulnerabilities in DUware DUportal PRO 3.4.3 allow remote attackers to execute arbitrary SQL commands via the (1) iChannel parameter to default.asp, (2) iData parameter to detail.asp, (3) iMem parameter to members.asp, (4) iCat…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.33%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Multiple SQL injection vulnerabilities in DUware DUportal PRO 3.4.3 allow remote attackers to execute arbitrary SQL commands via the (1) iChannel parameter to default.asp, (2) iData parameter to detail.asp, (3) iMem parameter to members.asp, (4) iCat parameter to cat.asp, (5) offset parameter to members_listing_approval.asp, or (6) iChannel parameter to channels_edit.asp.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 1.33% probability · 69th percentile
- CISA KEV
- Not listed
- Affected
- duware/duportal pro
- Source
- cve@mitre.org
References
- http://echo.or.id/adv/adv19-theday-2005.txtExploit, Vendor Advisory
- http://marc.info/?l=bugtraq&m=111945219205114&w=2
- http://www.osvdb.org/17597
- http://www.osvdb.org/17598
- http://www.osvdb.org/17599
- http://echo.or.id/adv/adv19-theday-2005.txtExploit, Vendor Advisory
- http://marc.info/?l=bugtraq&m=111945219205114&w=2
- http://www.osvdb.org/17597
- http://www.osvdb.org/17598
- http://www.osvdb.org/17599
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.