Interinfo

Authenticated remote attackers can exploit a SQL injection vulnerability in Interinfo's DreamMaker software to execute arbitrary database queries, leading to unauthorized data exfiltration or destruction.

DreamMaker by Interinfo is vulnerable to arbitrary file read via relative path traversal, allowing unauthenticated attackers to download arbitrary system files.

DreamMaker by Interinfo is vulnerable to arbitrary file upload, allowing privileged remote attackers to upload and execute web shell backdoors, enabling arbitrary code execution on the server.