EUVD-2006-6350

Malware in sbrugna...

CVE-2006-6367

Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the 1 iFile or 2 action parameter. NOTE: the iType parameter is already covered by CVE-2005-3976...

CVE-2006-6367

CVE-2006-6367 describes multiple SQL injection vulnerabilities in DUware DUdownload 1.1 (and possibly earlier) specifically in detail.asp, exploitable via the iFile or action parameters (the iType parameter is covered by CVE-2005-3976). The vulnerability allows remote attackers to execute arbitra...

CVE-2006-6367

Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the 1 iFile or 2 action parameter. NOTE: the iType parameter is already covered by CVE-2005-3976...

aria-dudown.txt

Aria-Security Team Advisory Original Advisory: http://www.aria-security.com/forum/showthread.php?t=60 ----------------------------------------------------------- Software: DuDownload Method: SQL Injection Vendor: http://duware.com PoC: http://target/type.asp?iType=SQL Injection...