CVE-2004-2202: Undefined Security Weakness

Multiple SQL injection vulnerabilities in DUware DUclassified 4.0 through 4.2 allows remote attackers to bypass authentication and execute other commands on the server's underlying database via the 1 catid or 2 subid parameters in adDetail.asp, or 2 the password parameter in the login form...

CVE-2004-2200: Undefined Security Weakness

Cross-site scripting XSS vulnerability in DUware DUforum 3.0 through 3.1 allows remote attackers to inject arbitrary web script or HTML via via the message text...

DUamazon Pro Multiple Scripts SQL Injection

The remote host is running DUamazon Pro, an ASP-based storefront from DUware for Amazon affiliates. The installed version of DUamazon Pro fails to properly sanitize user- supplied input in several instances before using it in SQL queries. By exploiting these flaws, an attacker can affect database...

CVE-2005-2046

Multiple SQL injection vulnerabilities in DUware DUamazon Pro 3.0 and 3.1 allow remote attackers to execute arbitrary SQL commands via the 1 iCat parameter to cat.asp, 2 iSub parameter to sub.asp, 3 iSub parameter to detail.asp, 4 iPro parameter to review.asp, iCat parameter to 5 catEdit.asp, 6...

CVE-2005-2045

Multiple SQL injection vulnerabilities in DUware DUportal PRO 3.4.3 allow remote attackers to execute arbitrary SQL commands via the 1 iChannel parameter to default.asp, 2 iData parameter to detail.asp, 3 iMem parameter to members.asp, 4 iCat parameter to cat.asp, 5 offset parameter to...

CVE-2005-2046

CVE-2005-2046 affects DUware DUamazon Pro 3.0 and 3.1 (ASP storefront). The vulnerability consists of multiple SQL injection flaws where attacker-controlled input in various parameters (iCat, iSub, iPro, and iType across cat.asp, sub.asp, detail.asp, review.asp, catEdit.asp, catDelete.asp, produc...

CVE-2005-2048

Multiple SQL injection vulnerabilities in DUware DUforum 3.1, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the 1 iMsg parameter to messages.asp, iFor parameter to 2 post.asp or 3 forums.asp, or 4 id parameter to userEdit.asp. NOTE: vectors 1 and 3 were...

CVE-2005-2047

Multiple SQL injection vulnerabilities in DUware DUpaypal Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the 1 iCat parameter to cat.asp, 2 iPro parameter to detail.asp, 3 iSub parameter to sub.asp, 4 iCat parameter to catEdit.asp...

CVE-2005-2045

CVE-2005-2045 concerns multiple SQL injection flaws in DUportal Pro 3.4.3 from DUware. The product does not properly sanitize user input before using it in SQL queries, enabling remote attackers to affect database queries. Affected parameters include (1) iChannel to default.asp, (2) iData to deta...

CVE-2005-2047

Multiple SQL injection vulnerabilities in DUware DUpaypal Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the 1 iCat parameter to cat.asp, 2 iPro parameter to detail.asp, 3 iSub parameter to sub.asp, 4 iCat parameter to catEdit.asp...

CVE-2005-2049

CVE-2005-2049 affects DuWare Duclassmate 1.2. The vulnerability is a SQL injection in the ASP web app where unsanitized input from (1) iState to default.asp and (2) iPro to edit.asp is used in SQL queries. This allows remote attackers to execute arbitrary SQL commands and potentially access/modif...

CVE-2005-2049

Multiple SQL injection vulnerabilities in DUware DUclassmate 1.2 allow remote attackers to execute arbitrary SQL commands via the 1 iState parameter to default.asp or 2 iPro parameter to edit.asp...

CVE-2005-2048

Summary (CVE-2005-2048): DUforum 3.1 (DUware) is affected by multiple SQL injection vulnerabilities due to improper input sanitization. The exploitable parameters are (1) iMsg in messages.asp, (2) iFor in post.asp, (3) iFor in forums.asp, and (4) id in userEdit.asp. This allows remote attackers t...

CVE-2005-2047

Affected product: DUware DUpaypal Pro (3.0; 3.1 noted in related CVEs) is affected by multiple SQL injection vulnerabilities. Vulnerability: Improper sanitization of user-supplied input enables remote attackers to craft SQL queries via specific parameters and pages: iCat to cat.asp (and catEdit.a...

CVE-2005-2046

Multiple SQL injection vulnerabilities in DUware DUamazon Pro 3.0 and 3.1 allow remote attackers to execute arbitrary SQL commands via the 1 iCat parameter to cat.asp, 2 iSub parameter to sub.asp, 3 iSub parameter to detail.asp, 4 iPro parameter to review.asp, iCat parameter to 5 catEdit.asp, 6...

CVE-2005-2048

Multiple SQL injection vulnerabilities in DUware DUforum 3.1, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the 1 iMsg parameter to messages.asp, iFor parameter to 2 post.asp or 3 forums.asp, or 4 id parameter to userEdit.asp. NOTE: vectors 1 and 3 were...

CVE-2005-2049

Multiple SQL injection vulnerabilities in DUware DUclassmate 1.2 allow remote attackers to execute arbitrary SQL commands via the 1 iState parameter to default.asp or 2 iPro parameter to edit.asp...

DUware DUforum 3.0/3.1 - 'forums.asp?iFor' SQL Injection

source: https://www.securityfocus.com/bid/14035/info DUforum is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could allow an attacker to compromise the application, access...

DUware DUamazon Pro 3.0/3.1 - 'productEdit.asp?iCat' SQL Injection

source: https://www.securityfocus.com/bid/14033/info DUamazon Pro is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could result in a compromise ...

DUware DUpaypal 3.0/3.1 - 'sub.asp?iSub' SQL Injection

source: https://www.securityfocus.com/bid/14034/info DUpaypal Pro is prone to multiple SQL-injection vulnerabilities because the fails application to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could allow an attacker to compromise the application,...