CVE-2004-2201

EPSS 1.3%

SQL injection vulnerability in DUware DUforum 3.0 through 3.1 allows remote attackers to execute arbitrary SQL commands via the FOR_ID parameter in messages.asp, (2) MSG_ID parameter in messageDetail.asp, or (3) password parameter in the login form.

Affected products

n/a · n/a

public PoCs found — 3

exploitdbwww.exploit-db.com/exploits/24675unverified exploitdbwww.exploit-db.com/exploits/24674unverified exploitdbwww.exploit-db.com/exploits/24673unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/17680 http://www.osvdb.org/10664 http://www.osvdb.org/10665 http://www.osvdb.org/10666 http://www.securityfocus.com/bid/11363 http://www.securitytracker.com/alerts/2004/Oct/1011595.html