Exploitation Summary
EIP tracks 2 public exploits for CVE-2009-4745. PoCs published by infosecstuff.
AI-analyzed exploit summary The exploit demonstrates XSS and SQL injection vulnerabilities in Dream Poll 3.1 via crafted URL parameters. The XSS payload triggers a JavaScript alert, while SQLi payloads manipulate the 'sortField' parameter to execute arbitrary SQL commands.
Description
Multiple SQL injection vulnerabilities in index.php in Dreamlevels DreamPoll 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) sortField, (2) sortDesc, or (3) pageNumber parameter in a login action.
Exploits (2)
The exploit demonstrates XSS and SQL injection vulnerabilities in Dream Poll 3.1 via crafted URL parameters. The XSS payload triggers a JavaScript alert, while SQLi payloads manipulate the 'sortField' parameter to execute arbitrary SQL commands.
The document details XSS and SQL injection vulnerabilities in DreamPoll 3.1, including specific attack vectors via the 'recordsPerPage' and 'sortField' parameters. It provides example payloads and confirms vendor notification and patch release.