Sodahead Polls 2.0.2 Cross Site Scripting

2011-03-17T00:00:00
ID PACKETSTORM:99421
Type packetstorm
Reporter High-Tech Bridge SA
Modified 2011-03-17T00:00:00

Description

                                        
                                            `================================  
Vulnerability ID: HTB22894  
Reference: http://www.htbridge.ch/advisory/xss_in_sodahead_polls_wordpress_plugin_1.html  
Product: Sodahead Polls wordpress plugin  
Vendor: SodaHead.com ( SodaHead.com )   
Vulnerable Version: 2.0.2  
Vendor Notification: 03 March 2011   
Vulnerability Type: XSS (Cross Site Scripting)  
Status: Fixed by Vendor  
Risk level: Medium   
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)   
  
Vulnerability Details:  
The vulnerability exists due to failure in the "/wp-content/plugins/sodahead-polls/poll.php" script to properly sanitize user-supplied input in "customize" variable.  
User can execute arbitrary JavaScript code within the vulnerable application.  
Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.  
  
The following PoC is available:  
  
  
http://[host]/wp-content/plugins/sodahead-polls/poll.php?customize=%27;%3C/script%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E  
  
Solution: Upgrade to the most recent version  
  
  
================================  
Vulnerability ID: HTB22893  
Reference: http://www.htbridge.ch/advisory/xss_in_sodahead_polls_wordpress_plugin.html  
Product: Sodahead Polls wordpress plugin  
Vendor: SodaHead.com ( SodaHead.com )   
Vulnerable Version: 2.0.2  
Vendor Notification: 03 March 2011   
Vulnerability Type: XSS (Cross Site Scripting)  
Risk level: Medium   
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)   
  
Vulnerability Details:  
The vulnerability exists due to failure in the "/wp-content/plugins/sodahead-polls/customizer.php" script to properly sanitize user-supplied input in "poll_id" variable.  
User can execute arbitrary JavaScript code within the vulnerable application.  
Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.  
  
The following PoC is available:  
  
  
http://[host]/wp-content/plugins/sodahead-polls/customizer.php?poll_id=%27%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E  
  
  
`