CVE-2006-6354

Published: Dec 7, 2006Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Multiple SQL injection vulnerabilities in detail.asp in DuWare DuNews allow remote attackers to execute arbitrary SQL commands via the (1) iNews, (2) iType, or (3) Action parameter. NOTE: the iType parameter in type.asp is covered by CVE-2005-3976.

Affected (25)

Products: Duware: Duamazon, Duarticle, Duclassified, Dudirectory, Dudirectory Pro, Dudirectory Pro Sql, Dudownload, Dugallery, Dunews, Dupaypal, Dupaypal Pro

11 products

Configuration A

25 vulnerable

Vulnerable Software	Affected Versions
Duware Duamazon	Version 3.0
Duware Duamazon	Version 3.1
Duware Duarticle	Version 1.0
Duware Duarticle	Version 1.1
Duware Duclassified	Version 4.0
Duware Duclassified	Version 4.1
Duware Duclassified	Version 4.2
Duware Dudirectory	Version 3.0
Duware Dudirectory	Version 3.1
Duware Dudirectory Pro	Version 3.0
Duware Dudirectory Pro	Version 3.1
Duware Dudirectory Pro Sql	Version 3.0
Duware Dudirectory Pro Sql	Version 3.1
Duware Dudownload	Version 1.0
Duware Dudownload	Version 1.1
Duware Dugallery	Version 3.0
Duware Dugallery	Version 3.1
Duware Dugallery	Version 3.2
Duware Dugallery	Version 3.3
Duware Dunews	Version 1.0
Duware Dunews	Version 1.1
Duware Dupaypal	Version 3.0
Duware Dupaypal	Version 3.1
Duware Dupaypal Pro	Version 3.0
Duware Dupaypal Pro	Version 3.1