PT-2005-2988 · Duamazon · Duamazon Pro

Dedi Dwianto · Published 2005-06-22 · Updated 2016-10-18 · CVE-2005-2046

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DUamazon Pro versions 3.0 through 3.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several API endpoints, including "cat.asp", "sub.asp", "detail.asp", "review.asp", "catEdit.asp", "catDelete.asp", "productEdit.asp", "productDelete.asp", and "type.asp", by manipulating specific parameters: iCat, iSub, iPro, and iType.

Recommendations For DUamazon Pro versions 3.0 and 3.1, consider disabling access to the vulnerable API endpoints until a patch is available. Restrict the use of parameters iCat, iSub, iPro, and iType in the affected endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2005-2046

Affected Products

Duamazon Pro

References · 10

• 🔥 https://exploit-db.com/exploits/25862 · Exploit
• 🔥 https://exploit-db.com/exploits/25864 · Exploit
• 🔥 https://exploit-db.com/exploits/25860 · Exploit
• 🔥 https://exploit-db.com/exploits/25863 · Exploit
• 🔥 https://exploit-db.com/exploits/25865 · Exploit
• 🔥 http://echo.or.id/adv/adv19-theday-2005.txt · Exploit
• 🔥 https://exploit-db.com/exploits/25867 · Exploit
• 🔥 https://exploit-db.com/exploits/25861 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-2046 · Security Note
• http://marc.info/?l=bugtraq&m=111945219205114&w=2 · Note