CVE-2006-6367

HIGH 7.5CVE-2006-6367 · Published 07/12/2006 · updated 16/06/2026

In short

CVE-2006-6367 is a HIGH (CVSS 7.5) vulnerability affecting dudownload (duware), dunews (duware), dupaypal (duware).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 75.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
dudownload duware	`= 1.0= 1.1`	No fix yet
dunews duware	`= 1.0= 1.1`	No fix yet
dupaypal duware	`= 3.0= 3.1= pro_3.0= pro_3.1`	No fix yet

Description

Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) iFile or (2) action parameter. NOTE: the iType parameter is already covered by CVE-2005-3976.

References

marc.info · Mailing List
secunia.com/advisories/23224 · Vendor Advisory
aria-security.com/forum/showthread.php · Broken Link
securityfocus.com/bid/21405 · Exploit
vupen.com/english/advisories/2006/4845 · Not Applicable
exchange.xforce.ibmcloud.com/vulnerabilities/30669

More vulnerabilities in dudownload

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free