Description
Multiple SQL injection vulnerabilities in DUware DUportal Pro 3.4 allow remote attackers to execute arbitrary SQL commands via the (1) nChannel parameter to default.asp, cat.asp, or detail.asp, (2) the iChannel parameter to search.asp, default.asp, result.asp, cat.asp, or detail.asp (3) the iCat parameter to cat.asp or detail.asp, (4) the iData parameter to detail.asp or result.asp, the (5) POL_ID, (6) POL_PARENT, (7) POL_CATEGORY, (8) CHA_NAME, or (9) CHA_ID parameters to inc_vote.asp, or the (10) tfm_order or (11) tfm_orderby parameters to toppages.asp, a different set of vulnerabilities than CVE-2005-1236.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 6
- DUportal Pro 3.4 - 'default.asp' Multiple SQL Injections EDB-25476 · webapps · Apr 20, 2005 · verified
- DUportal Pro 3.4 - 'search.asp?iChannel' SQL Injection EDB-25477 · webapps · Apr 20, 2005 · verified
- DUportal Pro 3.4 - 'inc_vote.asp' Multiple SQL Injections EDB-25478 · webapps · Apr 20, 2005 · verified
- DUportal Pro 3.4 - 'result.asp' Multiple SQL Injections EDB-25479 · webapps · Apr 20, 2005 · verified
- DUportal Pro 3.4 - 'cat.asp' Multiple SQL Injections EDB-25480 · webapps · Apr 20, 2005 · verified
- DUportal Pro 3.4 - 'detail.asp' Multiple SQL Injections EDB-25481 · webapps · Apr 20, 2005 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 13285 vdb-entry
- http://www.securiteam.com/windowsntfocus/5TP0O0AFFQ.html
- 20061202 [Aria-Security Team] DuWare DuPortal SQL Injection Vuln mailing-list
- http://www.digitalparadox.org/advisories/duppro.txt
- 20050420 DUportal Pro 3.4 has MANY Sql injection and Sql Errors. mailing-list
- duportal-multiple-sql-injection(20197) vdb-entry
- 15031 third-party-advisory
- duportal-default-cat-sql-injection(30671) vdb-entry