CVE-2006-6354: Duware Duamazon

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in detail.asp in DuWare DuNews allow remote attackers to execute arbitrary SQL commands via the (1) iNews, (2) iType, or (3) Action parameter. NOTE: the iType parameter in type.asp is covered by CVE-2005-3976.

Affected products

• Duware Duamazon: version 3.0 only; version 3.1 only
• Duware Duarticle: version 1.0 only; version 1.1 only
• Duware Duclassified: version 4.0 only; version 4.1 only; version 4.2 only
• Duware Dudirectory: version 3.0 only; version 3.1 only
• Duware Dudirectory Pro: version 3.0 only; version 3.1 only
• Duware Dudirectory Pro SQL: version 3.0 only; version 3.1 only
• Duware Dudownload: version 1.0 only; version 1.1 only
• Duware Dugallery: version 3.0 only; version 3.1 only; version 3.2 only; version 3.3 only
• Duware Dunews: version 1.0 only; version 1.1 only
• Duware Dupaypal: version 3.0 only; version 3.1 only
• Duware Dupaypal Pro: version 3.0 only; version 3.1 only

Published 2006-12-07. Last modified 2026-06-16.