OSVDB ID: 10669

Title: DUclassified adDetail.asp Multiple Parameter SQL Injection

Info

Disclosure
Oct 12, 2004

Discovery
Oct 09, 2004

Dates

Exploit
Oct 09, 2004

Solution
Unknown

Description

 DUClassified contains a flaw that will allow an attacker to inject arbitrary SQL code. The problem is that the cat_id and sub_id variables in the adDetail.asp module are not verified properly and will allow an attacker to inject or manipulate SQL queries.

Classification

 Location: Remote/Network Access Required
Attack Type: Information Disclosure, Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Available
OSVDB: Web Related

Solution

 Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

DUware

DUclassified

 4.2
4.1
4.0

References

Credit
  • Soroush Dalili - irsdlBrand New Doo Dooyahoo.com - Grayhatz security group


Direct URL: http://osvdb.org/36218