CVE-2004-2202

critical

Description

Multiple SQL injection vulnerabilities in DUware DUclassified 4.0 through 4.2 allows remote attackers to bypass authentication and execute other commands on the server's underlying database via the (1) cat_id or (2) sub_id parameters in adDetail.asp, or (2) the password parameter in the login form.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/17685

https://euvd.enisa.europa.eu/vulnerability/EUVD-2004-2194

http://www.securitytracker.com/alerts/2004/Oct/1011596.html

http://www.securityfocus.com/bid/11363

http://www.osvdb.org/10669

http://www.osvdb.org/10668

Details

Source: Mitre, NVD

Published: 2004-12-31

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.01452