CVE-2006-6367
Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly...
CVE-2006-6367 is a high vulnerability (CVSS 7.5) in Duware Dudownload, published December 7, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.59%, the 75th percentile. No source names a fixed version.
Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) iFile or (2) action parameter. NOTE: the iType parameter is already covered by CVE-2005-3976.
Exploit likelihood
What each source reports
NVD Score used
Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) iFile or (2) action parameter. NOTE: the iType parameter is already covered by CVE-2005-3976.
- Record
CVE-2006-6367- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) iFile or (2) action parameter. NOTE: the iType parameter is already covered by CVE-2005-3976.
- Record
CVE-2006-6367- Updated
- 2026-11-02
EUVDEUVD-2006-6350 No score
Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) iFile or (2) action parameter. NOTE: the iType parameter is already covered by CVE-2005-3976.
- Record
EUVD-2006-6350- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h3f8-qq4m-pp68 No score
Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly...
Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) iFile or (2) action parameter. NOTE: the iType parameter is already covered by CVE-2005-3976.
- Record
GHSA-h3f8-qq4m-pp68- Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | DUdownload 1.0/1.1 - 'detail.asp' Multiple SQL Injections | 2006-12-02 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD |
References
securityfocus.com/bid/21405
secunia.com/advisories/23224
exchange.xforce.ibmcloud.com/vulnerabilities/30669
vupen.com/english/advisories/2006/4845
aria-security.com/forum/showthread.php?t=60
marc.info?l=bugtraq&m=116508632603388&w=2
nvd.nist.gov/vuln/detail/CVE-2006-6367
github.com/advisories/GHSA-h3f8-qq4m-pp68