CVE-2009-4746
Description
Cross-site scripting (XSS) vulnerability in index.php in Dreamlevels DreamPoll 3.1 allows remote attackers to inject arbitrary web script or HTML via the recordsPerPage parameter in a poll_default login action.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
DreamPoll 3.1 - SQL Injection
During a recent security audit of the DreamPoll 3.1 software by Dreamlevels, I discovered a number of XSS and SQL Injection vulnerabilities in the application. These vulnerabilities could be exploited to make unauthorized changes to a web site or compromise a client accessing a site that utilizes the application. Details of the vulnerabilities are as follows:
XSS
????????-
File: index.php
Variable: recordsPerPage
Example: GET /index.php?action=loginsortField=poll_default&sortDesc=1&recordsPerPage=
1>?><ScRiPt%20%0d%0a>alert(911)%3B</ScRiPt>
Blind SQL/Xpath Injection
????????-
File: index.php
Variable: sortField
Example: GET /index.php?action=loginsortField=poll_default+and+31337-31337=0&sortDesc
=1&recordsPerPage=20
Blind SQL Injection (Timing)
????????-
File: index.php
Variables: sortField, sortDesc, pageNumber
Example: GET /index.php?action=loginsortField=poll_default+and+sleep(3)%23&sortDesc=1
&recordsPerPage=20
While not specifically tested, it is likely these vulnerabilities exist in earlier versions of this application as well. The vendor was notified on 09/28/2009 and a fix was released the same day. If you are a current user of this software, contact the vendor for the available fix.
http://www.infosecstuff.comApplication impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| dreamlevels | dreampoll | 3.1 | |
References
CWEs
CWE-79
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.