PT-2005-2987 · Unknown · Duportal Pro

Dedi Dwianto · Published 2005-06-22 · Updated 2016-10-18 · CVE-2005-2045

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DUportal PRO version 3.4.3

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters, including the iChannel parameter to "default.asp", the iData parameter to "detail.asp", the iMem parameter to "members.asp", the iCat parameter to "cat.asp", the offset parameter to "members listing approval.asp", or the iChannel parameter to "channels edit.asp".

Recommendations For DUportal PRO version 3.4.3, as a temporary workaround, consider restricting access to the affected API endpoints, such as "default.asp", "detail.asp", "members.asp", "cat.asp", "members listing approval.asp", and "channels edit.asp", until a patch is available. Avoid using the parameters iChannel, iData, iMem, iCat, and offset in the respective affected endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-2045

Affected Products

Duportal Pro

References · 6

• 🔥 http://echo.or.id/adv/adv19-theday-2005.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-2045 · Security Note
• http://marc.info/?l=bugtraq&m=111945219205114&w=2 · Note
• http://osvdb.org/17599 · Note
• http://osvdb.org/17598 · Note
• http://osvdb.org/17597 · Note