DUware DUclassmate Multiple SQL Injection Vulnerabilities
BID:14036
Info
DUware DUclassmate Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 14036 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-2049 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 22 2005 12:00AM |
| Updated: | May 12 2015 07:52PM |
| Credit: | dedi dwianto <[email protected]> is credited with the discovery of this vulnerability. |
| Vulnerable: |
DUware DUportal Pro 3.4.3 DUware DUclassmate 1.2 DUware DUclassmate 1.1 DUware DUclassmate 1.0 |
| Not Vulnerable: | |
Discussion
DUware DUclassmate Multiple SQL Injection Vulnerabilities
DUclassmate is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
DUclassmate is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
Exploit / POC
DUware DUclassmate Multiple SQL Injection Vulnerabilities
No exploit is required.
The following proof-of-concept URIsare available:
http://www.example.com/DUclassmate/default.asp?iState=[SQL Inject]&nState=Florida
http://www.example.com/DUclassmate/admin/edit.asp?iPro=[SQL Inject]
No exploit is required.
The following proof-of-concept URIsare available:
http://www.example.com/DUclassmate/default.asp?iState=[SQL Inject]&nState=Florida
http://www.example.com/DUclassmate/admin/edit.asp?iPro=[SQL Inject]
Solution / Fix
DUware DUclassmate Multiple SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
DUware DUclassmate Multiple SQL Injection Vulnerabilities
References:
References:
- DUware Homepage (DUware)
- [Aria-Security Team] DuWare DuClassMate SQL Injection Vuln (Aria-Security)
- [ECHO_ADV_19$2005] Multiple SQL INJECTION in DUWARE Products (dedi dwianto