Dream Poll 'index.php' Cross-Site Scripting and SQL Injection Vulnerabilities

Bugtraq ID:	36663
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 13 2009 12:00AM
Updated:	Mar 19 2015 09:13AM
Credit:	infosecstuff
Vulnerable:	Dream Levels Dream Poll 3.1
Not Vulnerable:

Dream Poll 'index.php' Cross-Site Scripting and SQL Injection Vulnerabilities

Dream Poll is prone to a cross-site scripting vulnerability and multiple SQL-injection vulnerabilities.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Dream Poll 3.1 is vulnerable; other versions may also be affected.

Dream Poll 'index.php' Cross-Site Scripting and SQL Injection Vulnerabilities

An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice a victim user to follow a malicious URI.

The following example URIs are available:

• /data/vulnerabilities/exploits/36663.txt

Dream Poll 'index.php' Cross-Site Scripting and SQL Injection Vulnerabilities

Solution:
Reports indicate that this issue has been fixed. Please contact the vendor for more information.

Dream Poll 'index.php' Cross-Site Scripting and SQL Injection Vulnerabilities

References:

• Dream Poll Homepage (DreamLevels)
  
• DreamPoll 3.1 Vulnerabilities ([email protected])