DSPoll PollID SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1195744 漏洞类型 SQL注入
发布时间 2006-03-13 更新时间 2006-03-14
CVE编号 CVE-2006-1217 CNNVD-ID CNNVD-200603-243
漏洞平台 N/A CVSS评分 7.5
|漏洞来源
https://cxsecurity.com/issue/WLB-2006030108
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200603-243
|漏洞详情
在DSPoll1.1中存在SQL注入漏洞,远程攻击者可通过以下途径执行任意SQL命令:用于(1)results.php,(2)topolls.php,(3)pollit.php的pollid参数。
|漏洞EXP
New eVuln Advisory:
DSPoll Multiple SQL Injection Vulnerabilities
http://evuln.com/vulns/96/summary.html

--------------------Summary----------------
eVuln ID: EV0096
CVE: CVE-2006-1217
Software: DSPoll
Sowtware's Web Site: http://dsportal.uw.hu/
Versions: 1.1
Critical Level: Moderate
Type: SQL Injection
Class: Remote
Status: Unpatched. No reply from developer(s)
PoC/Exploit: Available
Solution: Not Available
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)

-----------------Description---------------
Vulnerable scripts:
include/results.php
include/topolls.php
include/pollit.php

Variable $pollid isn't properly sanitized before being used in the SQL query. This can be used to make any SQL query by injecting arbitrary SQL code.

Condition: magic_quotes_gpc = off

--------------PoC/Exploit----------------------
Available at: http://evuln.com/vulns/96/exploit.html

--------------Solution---------------------
No Patch available.

--------------Credit-----------------------
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)

Regards,
Aliaksandr Hartsuyeu
http://evuln.com - Penetration Testing Services
.
|参考资料

来源:VUPEN
名称:ADV-2006-0932
链接:http://www.frsirt.com/english/advisories/2006/0932
来源:SECUNIA
名称:19209
链接:http://secunia.com/advisories/19209
来源:MISC
链接:http://evuln.com/vulns/96/summary.html
来源:XF
名称:dspoll-pollid-sql-injection(25192)
链接:http://xforce.iss.net/xforce/xfdb/25192
来源:BID
名称:17103
链接:http://www.securityfocus.com/bid/17103
来源:BUGTRAQ
名称:20060324[eVuln]DSPollMultipleSQLInjectionVulnerabilities
链接:http://www.securityfocus.com/archive/1/archive/1/428663/100/0/threaded
来源:OSVDB
名称:23881
链接:http://www.osvdb.org/23881
来源:OSVDB
名称:23880
链接:http://www.osvdb.org/23880
来源:OSVDB
名称:23879
链接:http://www.osvdb.org/23879
来源:SECTRACK
名称:1015758
链接:http://securitytracker.com/id?1015758
来源:SREASON
名称:622
链接:http://securityreason.com/securityalert/622
来源:SREASON
名称:620
链接:http://securityreason.com/securityalert/620