Description
Multiple SQL injection vulnerabilities in detail.asp in DuWare DuNews allow remote attackers to execute arbitrary SQL commands via the (1) iNews, (2) iType, or (3) Action parameter. NOTE: the iType parameter in type.asp is covered by CVE-2005-3976.
References
- 23228 third-party-advisory
- http://www.aria-security.com/forum/showthread.php?t=61
- 15681 vdb-entry
- ADV-2006-4834 vdb-entry
- 20061202 [Aria-Security Team] DuWare DuNews SQL Injection Vuln mailing-list
- dunews-type-detail-sql-injection(30673) vdb-entry
- 1996 third-party-advisory