PT-2005-2988 · Duamazon · Duamazon Pro

Dedi Dwianto · Publicado 2005-06-22 · Atualizado 2016-10-18 · CVE-2005-2046

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DUamazon Pro versions 3.0 through 3.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several API endpoints, including "cat.asp", "sub.asp", "detail.asp", "review.asp", "catEdit.asp", "catDelete.asp", "productEdit.asp", "productDelete.asp", and "type.asp", by manipulating specific parameters: iCat, iSub, iPro, and iType.

Recommendations For DUamazon Pro versions 3.0 and 3.1, consider disabling access to the vulnerable API endpoints until a patch is available. Restrict the use of parameters iCat, iSub, iPro, and iType in the affected endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2005-2046

Produtos afetados

Duamazon Pro

Referências · 10

• 🔥 https://exploit-db.com/exploits/25862 · Exploit
• 🔥 https://exploit-db.com/exploits/25864 · Exploit
• 🔥 https://exploit-db.com/exploits/25860 · Exploit
• 🔥 https://exploit-db.com/exploits/25863 · Exploit
• 🔥 https://exploit-db.com/exploits/25865 · Exploit
• 🔥 http://echo.or.id/adv/adv19-theday-2005.txt · Exploit
• 🔥 https://exploit-db.com/exploits/25867 · Exploit
• 🔥 https://exploit-db.com/exploits/25861 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-2046 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=111945219205114&w=2 · Nota