{"id":"CVE-2005-2046","aliases":["EUVD-2005-2048","GHSA-x3rc-35mx-mpj8"],"status":"published","title":"Multiple SQL injection vulnerabilities in DUware DUamazon Pro 3.0 and 3.1 allow remote attackers...","description":"Multiple SQL injection vulnerabilities in DUware DUamazon Pro 3.0 and 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) iCat parameter to cat.asp, (2) iSub parameter to sub.asp, (3) iSub parameter to detail.asp, (4) iPro parameter to review.asp, iCat parameter to (5) catEdit.asp, (6) catDelete.asp, (7) productEdit.asp, or (8) productDelete.asp, or (9) iType parameter to type.asp.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02083,"percentile":0.81665,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2005-06-22T04:00:00Z","modified":"2026-06-16T22:14:08Z","exploits":[{"source":"exploitdb","id":"EDB-25860","title":"DUware DUamazon Pro 3.0/3.1 - 'type.asp?iType' SQL Injection","type":"webapps","platform":"php","date":"2005-06-22","verified":true,"url":"https://www.exploit-db.com/exploits/25860"},{"source":"exploitdb","id":"EDB-25861","title":"DUware DUamazon Pro 3.0/3.1 - 'productDelete.asp?iCat' SQL Injection","type":"webapps","platform":"php","date":"2005-06-22","verified":true,"url":"https://www.exploit-db.com/exploits/25861"},{"source":"exploitdb","id":"EDB-25862","title":"DUware DUamazon Pro 3.0/3.1 - 'productEdit.asp?iCat' SQL Injection","type":"webapps","platform":"php","date":"2005-06-22","verified":true,"url":"https://www.exploit-db.com/exploits/25862"},{"source":"exploitdb","id":"EDB-25863","title":"DUware DUamazon Pro 3.0/3.1 - 'catDelete.asp?iCat' SQL Injection","type":"webapps","platform":"asp","date":"2005-06-22","verified":true,"url":"https://www.exploit-db.com/exploits/25863"},{"source":"exploitdb","id":"EDB-25864","title":"DUware DUamazon Pro 3.0/3.1 - 'review.asp?iPro' SQL Injection","type":"webapps","platform":"asp","date":"2005-06-22","verified":true,"url":"https://www.exploit-db.com/exploits/25864"},{"source":"exploitdb","id":"EDB-25865","title":"DUware DUamazon Pro 3.0/3.1 - 'detail.asp?iSub' SQL Injection","type":"webapps","platform":"asp","date":"2005-06-22","verified":true,"url":"https://www.exploit-db.com/exploits/25865"},{"source":"exploitdb","id":"EDB-25867","title":"DUware DUpaypal 3.0/3.1 - 'sub.asp?iSub' SQL Injection","type":"webapps","platform":"asp","date":"2005-06-22","verified":true,"url":"https://www.exploit-db.com/exploits/25867"}],"products":[{"vendor":"duware","product":"duamazon_pro"}],"references":[{"url":"http://marc.info/?l=bugtraq\u0026m=111945219205114\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://echo.or.id/adv/adv19-theday-2005.txt","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-2046"},{"url":"https://github.com/advisories/GHSA-x3rc-35mx-mpj8"}],"sources":{"cve":[{"id":"CVE-2005-2046","description":"Multiple SQL injection vulnerabilities in DUware DUamazon Pro 3.0 and 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) iCat parameter to cat.asp, (2) iSub parameter to sub.asp, (3) iSub parameter to detail.asp, (4) iPro parameter to review.asp, iCat parameter to (5) catEdit.asp, (6) catDelete.asp, (7) productEdit.asp, or (8) productDelete.asp, or (9) iType parameter to type.asp.","status":"published","published":"2005-06-22T04:00:00Z","modified":"2024-08-07T22:15:36.831Z","updated_at":"2026-11-02T14:33:37.446553Z"}],"euvd":[{"id":"EUVD-2005-2048","description":"Multiple SQL injection vulnerabilities in DUware DUamazon Pro 3.0 and 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) iCat parameter to cat.asp, (2) iSub parameter to sub.asp, (3) iSub parameter to detail.asp, (4) iPro parameter to review.asp, iCat parameter to (5) catEdit.asp, (6) catDelete.asp, (7) productEdit.asp, or (8) productDelete.asp, or (9) iType parameter to type.asp.","status":"published","published":"2005-06-22T04:00:00Z","modified":"2024-08-07T22:15:36Z","updated_at":"2026-11-03T01:15:32.408501Z"}],"ghsa":[{"id":"GHSA-x3rc-35mx-mpj8","title":"Multiple SQL injection vulnerabilities in DUware DUamazon Pro 3.0 and 3.1 allow remote attackers...","description":"Multiple SQL injection vulnerabilities in DUware DUamazon Pro 3.0 and 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) iCat parameter to cat.asp, (2) iSub parameter to sub.asp, (3) iSub parameter to detail.asp, (4) iPro parameter to review.asp, iCat parameter to (5) catEdit.asp, (6) catDelete.asp, (7) productEdit.asp, or (8) productDelete.asp, or (9) iType parameter to type.asp.","status":"published","published":"2022-05-01T02:04:27Z","modified":"2023-01-30T05:07:22Z","updated_at":"2026-11-02T14:47:40.819518Z"}],"nvd":[{"id":"CVE-2005-2046","description":"Multiple SQL injection vulnerabilities in DUware DUamazon Pro 3.0 and 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) iCat parameter to cat.asp, (2) iSub parameter to sub.asp, (3) iSub parameter to detail.asp, (4) iPro parameter to review.asp, iCat parameter to (5) catEdit.asp, (6) catDelete.asp, (7) productEdit.asp, or (8) productDelete.asp, or (9) iType parameter to type.asp.","status":"published","published":"2005-06-22T04:00:00Z","modified":"2026-06-16T22:14:08.31Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:00:55.600202Z"}]}}