CVE-2005-2048
DUware DUforum 3.1 - SQL Injection via iMsg, iFor, or id Parameter
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2005-2048. PoCs published by Dedi Dwianto.
AI-analyzed exploit summary This is a vulnerability writeup describing SQL injection flaws in DUforum's admin/userEdit.asp page. It lacks executable exploit code but provides a proof-of-concept URL pattern for exploitation.
Description
Multiple SQL injection vulnerabilities in DUware DUforum 3.1, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the (1) iMsg parameter to messages.asp, iFor parameter to (2) post.asp or (3) forums.asp, or (4) id parameter to userEdit.asp. NOTE: vectors 1 and 3 were later reported to affect version 3.0.
Exploits (4)
This is a vulnerability writeup describing SQL injection flaws in DUforum's admin/userEdit.asp page. It lacks executable exploit code but provides a proof-of-concept URL pattern for exploitation.
The provided text describes a SQL injection vulnerability in DUforum, where the 'iFor' parameter in 'post.asp' is not properly sanitized. It references a SecurityFocus BID but lacks actual exploit code or technical details.
The provided text describes a SQL injection vulnerability in DUforum, where the 'iMsg' parameter in 'messages.asp' is not properly sanitized. It includes an example URL demonstrating the vulnerability but lacks executable exploit code.
This is a vulnerability writeup describing SQL injection flaws in DUforum. It provides a high-level overview of the issue and a sample exploit URL but lacks executable PoC code.