Lucene search
HistoryJul 10, 2005 - 4:00 a.m.
CVE-2004-2201
cve-2004-2201
sql injection
duware duforum
remote attack
arbitrary sql commands
vulnerability
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
8.5 High
AI Score
Confidence
Low
0.003 Low
EPSS
Percentile
68.6%
SQL injection vulnerability in DUware DUforum 3.0 through 3.1 allows remote attackers to execute arbitrary SQL commands via the FOR_ID parameter in messages.asp, (2) MSG_ID parameter in messageDetail.asp, or (3) password parameter in the login form.
Affected configurations
Node
duwareduforumMatch3.0
ORduwareduforumMatch3.1
| CPE | Name | Operator | Version |
|---|---|---|---|
| duware:duforum | duware duforum | eq | 3.0 |
| duware:duforum | duware duforum | eq | 3.1 |
Related
nvd
nvd
CVE-2004-2201
2004-12-31 05:00:00
cvelist
cvelist
CVE-2004-2201
2005-07-10 04:00:00
nessus
nessus
DUware Products Multiple Remote Vulnerabilities (SQLi, XSS)
2004-10-11 00:00:00
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
8.5 High
AI Score
Confidence
Low
0.003 Low
EPSS
Percentile
68.6%
Related for CVE-2004-2201