high7.5Public exploit code
CVE-2004-2202
Multiple SQL injection vulnerabilities in DUware DUclassified 4.0 through 4.2 allows remote attackers to bypass authentication and execute other commands on th…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- DUclassified 4.x - 'adDetail.asp' Multiple SQL Injections2004-10-11 · webapps · asp · Verified
Impact
Multiple SQL injection vulnerabilities in DUware DUclassified 4.0 through 4.2 allows remote attackers to bypass authentication and execute other commands on the server's underlying database via the (1) cat_id or (2) sub_id parameters in adDetail.asp, or (2) the password parameter in the login form.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Duware | Duclassified | Versions 4.0, 4.1, 4.2 |
References
- NVD record
- CVE.org record
- http://www.osvdb.org/10668
- http://www.osvdb.org/10669
- http://www.securityfocus.com/bid/11363
- http://www.securitytracker.com/alerts/2004/Oct/1011596.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17685
- http://www.osvdb.org/10668
- http://www.osvdb.org/10669
- http://www.securityfocus.com/bid/11363
- http://www.securitytracker.com/alerts/2004/Oct/1011596.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17685