Exploitation Summary
EIP tracks 6 public exploits for CVE-2005-1224. PoCs published by Dcrab.
AI-analyzed exploit summary This exploit demonstrates SQL injection vulnerabilities in DUportal Pro 3.4 by injecting malicious input into the 'iChannel' parameter in various search.asp endpoints. The PoC provides multiple URLs with SQL injection payloads that can compromise the application or underlying database.
Description
Multiple SQL injection vulnerabilities in DUware DUportal Pro 3.4 allow remote attackers to execute arbitrary SQL commands via the (1) nChannel parameter to default.asp, cat.asp, or detail.asp, (2) the iChannel parameter to search.asp, default.asp, result.asp, cat.asp, or detail.asp (3) the iCat parameter to cat.asp or detail.asp, (4) the iData parameter to detail.asp or result.asp, the (5) POL_ID, (6) POL_PARENT, (7) POL_CATEGORY, (8) CHA_NAME, or (9) CHA_ID parameters to inc_vote.asp, or the (10) tfm_order or (11) tfm_orderby parameters to toppages.asp, a different set of vulnerabilities than CVE-2005-1236.
Exploits (6)
This exploit demonstrates SQL injection vulnerabilities in DUportal Pro 3.4 by injecting malicious input into the 'iChannel' parameter in various search.asp endpoints. The PoC provides multiple URLs with SQL injection payloads that can compromise the application or underlying database.
This exploit demonstrates SQL injection vulnerabilities in DUportal Pro 3.4 by providing multiple URLs with injected SQL payloads. The payloads target the 'iData', 'iCat', 'iChannel', and 'nChannel' parameters in the 'result.asp' script.
This exploit demonstrates SQL injection vulnerabilities in DUportal Pro 3.4 by providing multiple URLs with injected SQL payloads. The payloads target various parameters in the 'inc_vote.asp' script, showcasing how unsanitized input can be used to manipulate SQL queries.
This exploit demonstrates SQL injection vulnerabilities in DUportal Pro 3.4 by providing multiple URLs with injected SQL payloads. The URLs target various parameters in different modules of the application, showing how unsanitized input can be used to manipulate SQL queries.
This is a writeup detailing SQL injection vulnerabilities in DUportal Pro 3.4. It provides multiple example URLs demonstrating how unsanitized input in the 'iChannel' and 'nChannel' parameters can be exploited.
This exploit demonstrates SQL injection vulnerabilities in DUportal Pro 3.4 by providing multiple URLs with injected parameters. The URLs target various endpoints where user-supplied input is not properly sanitized, allowing for SQL query manipulation.