DMXready Polling Booth Manager SQLi Vulnerability

vendor:

Polling Booth Manager

by:

L0rd CrusAd3r

7,5

CVSS

HIGH

SQL Vulnerability

CWE

Product Name: Polling Booth Manager

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE: N/A

CPE: a:dmxready:polling_booth_manager

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

DMXready Polling Booth Manager SQLi Vulnerability

DMXReady Polling Booth Manager is a quick and fun way to make your website more interactive. It keeps all your web content fresh, and is a great way to find out what your visitors think. However, it is vulnerable to a SQL injection vulnerability which allows an attacker to execute arbitrary SQL commands on the underlying database.

Mitigation:

Input validation should be used to prevent SQL injection attacks. Additionally, the application should be configured to use parameterized queries.

Source

Exploit-DB raw data:

Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title: DMXready Polling Booth Manager SQLi Vulnerability
Vendor url:http://www.dmxready.com
Version:1
Price:79$
Published: 2010-09-6
GThanx to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat,
Sai, KD, M4n0j, The_Exploited, SeeMe, gunslinger_, Th3 RDX.
Greetz to : Inj3ct0r Exploit DataBase (inj3ct0r.com) , 0xr00t.com , members
and my friends :) etc....
Special Greetz: Topsecure.net, inj3ct0r Team ,Andhrahackers.com
Shoutzz:- To all ICW & Inj3ct0r members.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

DMXReady Polling Booth Manager is a quick and fun way to make your website
more interactive:

    * Change your poll daily, weekly, monthly -- whenever you like!
    * Find out what people think of you and your services, or post it just
for fun
    * Auto-archive old polls and results
    * Add multiple answer selections
    * Allow visitors to view results directly from the poll page
    * Doesn't allow visitors from voting more than once
    * Add images, question, and optional description of the poll
    * Add, edit, delete, or deactiviate any poll through one Admin page
    * Fully customizable - change the layout to match your website design

DMXReady Polling Booth Manager keeps all your web content fresh, and is a
great way to find out what your visitors think!


~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQL Vulnerability

DEMO URL:

http://server/inc_pollingboothmanager.asp?view=results&QuestionID=[sqli]


# 0day n0 m0re #
# L0rd CrusAd3r #

-- 
With R3gards,
L0rd CrusAd3r