PT-2010-1554 · Dreampoll · Dreampoll

Publicado 2010-03-26 · Atualizado 2018-10-10 · CVE-2009-4745

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DreamPoll version 3.1

Description The issue concerns SQL injection vulnerabilities in the index.php file of DreamPoll. Remote attackers can execute arbitrary SQL commands by manipulating the sortField, sortDesc, or pageNumber parameters in a login action.

Recommendations For DreamPoll version 3.1, consider restricting access to the login action or validating and sanitizing the sortField, sortDesc, and pageNumber parameters to prevent SQL injection attacks. As a temporary workaround, avoid using the vulnerable parameters in the login action until a patch is available.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-4745

Produtos afetados

Dreampoll

Referências · 4

• 🔥 https://exploit-db.com/exploits/10006 · Exploit
• 🔥 https://exploit-db.com/exploits/33282 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4745 · Nota de Segurança
• http://securityfocus.com/archive/1/507039/100/0/threaded · Nota