CVE-2006-6367

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-12-07 · updated 2026-06-16
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) iFile or (2) action parameter. NOTE: the iType parameter is already covered by CVE-2005-3976.

Affected products

Duware Dudownload: 1.0, 1.1
Duware Dunews: 1.0, 1.1
Duware Dupaypal: 3.0, 3.1, pro_3.0, pro_3.1

References

http://marc.info/?l=bugtraq&m=116508632603388&w=2
http://secunia.com/advisories/23224
http://www.aria-security.com/forum/showthread.php?t=60
http://www.securityfocus.com/bid/21405
http://www.vupen.com/english/advisories/2006/4845
https://exchange.xforce.ibmcloud.com/vulnerabilities/30669
http://marc.info/?l=bugtraq&m=116508632603388&w=2
http://secunia.com/advisories/23224
http://www.aria-security.com/forum/showthread.php?t=60
http://www.securityfocus.com/bid/21405
http://www.vupen.com/english/advisories/2006/4845
https://exchange.xforce.ibmcloud.com/vulnerabilities/30669

Get alerted when CVE-2006-6367 or the next vulnerability affects your stack