Published: 31/12/2004 Updated: 11/07/2017

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 765

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in DUware DUforum 3.0 up to and including 3.1 allows remote malicious users to execute arbitrary SQL commands via the FOR_ID parameter in messages.asp, (2) MSG_ID parameter in messageDetail.asp, or (3) password parameter in the login form.

Vulnerable Product	Search on Vulmon	Subscribe to Product
duware duforum 3.0
duware duforum 3.1

source: wwwsecurityfocuscom/bid/11363/info Multiple vulnerabilities have been identified in the software that may allow a remote attacker to carry out SQL injection and HTML injection attacks An attacker may also gain unauthorized access to a user's account DUclassmate may allow unauthorized remote attackers to gain access to a com ...

source: wwwsecurityfocuscom/bid/11363/info Multiple vulnerabilities have been identified in the software that may allow a remote attacker to carry out SQL injection and HTML injection attacks An attacker may also gain unauthorized access to a user's account DUclassmate may allow unauthorized remote attackers to gain access to a c ...

NVD-CWE-Other http://www.securityfocus.com/bid/11363 http://www.osvdb.org/10664 http://www.osvdb.org/10665 http://www.osvdb.org/10666 http://www.securitytracker.com/alerts/2004/Oct/1011595.html https://exchange.xforce.ibmcloud.com/vulnerabilities/17680 https://nvd.nist.gov https://www.exploit-db.com/exploits/24674/

CVE-2004-2201

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect