PT-2010-1554 · Dreampoll · Dreampoll

Published 2010-03-26 · Updated 2018-10-10 · CVE-2009-4745

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DreamPoll version 3.1

Description The issue concerns SQL injection vulnerabilities in the index.php file of DreamPoll. Remote attackers can execute arbitrary SQL commands by manipulating the sortField, sortDesc, or pageNumber parameters in a login action.

Recommendations For DreamPoll version 3.1, consider restricting access to the login action or validating and sanitizing the sortField, sortDesc, and pageNumber parameters to prevent SQL injection attacks. As a temporary workaround, avoid using the vulnerable parameters in the login action until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-4745

Affected Products

Dreampoll

References · 4

• 🔥 https://exploit-db.com/exploits/10006 · Exploit
• 🔥 https://exploit-db.com/exploits/33282 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4745 · Security Note
• http://securityfocus.com/archive/1/507039/100/0/threaded · Note