CVE:CVE-2005-1236
CNNVD:CNNVD-200505-530
DUware DUportal 3.1.2和3.1.2 SQL存在多个SQL注入漏洞， 远程攻击者可以通过(1)传给channel.asp或search.asp的iChannel参数，(2)传给detail.asp或inc_rating.asp的iData参数，(3)传给detail.asp或type.asp的iCat 参数，(4)传给inc_poll_voting.asp的DAT_PARENT参数，或(5)传给inc_rating.asp的iRate参数，执行任意SQL命令。是一组不同于CVE-2005-1224的漏洞。
solution:Upgrade duware duportal to a higher version than 3.1.2,3.1.2_sql,and avoid the version 3.1.2,3.1.2_sql