CVE-2005-3976

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-12-03 · updated 2026-06-16

Description

SQL injection vulnerability in type.asp, as used in multiple DUware products including (1) DUamazon 3.1, (2) DUarticle 1.1, (3) DUclassified 4.2, (4) DUdirectory 3.1 and DUdirectory Pro 3.0 and 3.0 SQL, (5) DUdownload 1.1, (6) DUgallery 3.3, (7) DUnews 1.1, and (8) DUpaypal 3.1 and DUpaypal Pro 3.0, allows remote attackers to execute arbitrary SQL commands via the iType parameter.

Affected products

Duware Duamazon: 3.1
Duware Duarticle: 1.1
Duware Duclassified: 4.2
Duware Dudirectory: 3.1
Duware Dudirectory Pro: 3.0
Duware Dudirectory Pro Sql: 3.0
Duware Dudownload: 1.1
Duware Dugallery: 3.3
Duware Dunews: 1.1
Duware Dupaypal: 3.1
Duware Dupaypal Pro: 3.0

References

http://secunia.com/advisories/17835
http://www.osvdb.org/21385
http://www.securityfocus.com/bid/15681
http://www.vupen.com/english/advisories/2005/2700
https://exchange.xforce.ibmcloud.com/vulnerabilities/30673
http://secunia.com/advisories/17835
http://www.osvdb.org/21385
http://www.securityfocus.com/bid/15681
http://www.vupen.com/english/advisories/2005/2700
https://exchange.xforce.ibmcloud.com/vulnerabilities/30673

Get alerted when CVE-2005-3976 or the next vulnerability affects your stack