https://www.exploit-db.com/exploits/25867
https://www.securityfocus.com/bid/89111
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200506-200

DUwareDUamazonPro3.0和3.1版本中存在多个SQL注入漏洞，远程攻击者可借助：(1)提交到cat.asp的iCat参数，(2)到sub.asp的iSub参数，(3)到detail.asp的iSub参数，(4)到review.asp的iPro参数，(5)到catEdit.asp，(6)catDelete.asp，(7)productEdit.asp，或(8)productDelete.asp的iCat参数，或(9)提交到type.asp的iType参数，来执行任意SQL指令。

source: http://www.securityfocus.com/bid/14034/info
 
DUpaypal Pro is prone to multiple SQL-injection vulnerabilities because the fails application to properly sanitize user-supplied input before using it in SQL queries.
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/DUpaypalPro/shops/sub.asp?iSub=[SQL Inject]

DUWare Duamazon Pro 3.1

DUWare Duamazon Pro 3.0

来源:BUGTRAQ
名称:20050622[ECHO_ADV_19$2005]MultipleSQLINJECTIONinDUWAREProducts
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=111945219205114&w;=2
来源:MISC
链接:http://echo.or.id/adv/adv19-theday-2005.txt