[tech] DUforum SQL Vulnerabilities

[nickdw]

TITLE:
DUware DUforum SQL Injection Vulnerabilities

SECUNIA ADVISORY ID:
SA15802

VERIFY ADVISORY:
http://secunia.com/advisories/15802/

CRITICAL:
Moderately critical

IMPACT:
Manipulation of data

WHERE:
>From remote

SOFTWARE:
DUware DUforum 3.x
http://secunia.com/product/2855/

DESCRIPTION:
Dedi Dwianto has reported some vulnerabilities in DUforum, which can
be exploited by malicious people to conduct SQL injection attacks.

Certain input in some scripts isn't properly sanitised before being
used in a SQL query. This can be exploited to manipulate SQL queries
by injecting arbitrary SQL code.

The vulnerabilities have been reported in version 3.1. Other versions
may also be affected.

SOLUTION:
Filter malicious characters and character sequences in a proxy or
firewall with URL filtering capabilities.

Use another product.

PROVIDED AND/OR DISCOVERED BY:
Dedi Dwianto

ORIGINAL ADVISORY:
http://echo.or.id/adv/adv19-theday-2005.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

[ET Awful]

1. Well, DU is powered by DCForum+ Version 1.1

I'm not sure what DUForum is.

[Elad]

2. I'm locking this

You do realize that "DUware" is a company that makes software for websites, but is completely independent from Democratic Underground? We do not use their software.
http://www.duware.com/home/

Do to the potential for confusion, I'm locking this thread.