# Exploit Title: WordPress CP Polls 1.0.8 - CSRF - Update poll settings & Persistent XSS # Date: 2016-02-22 # Google Dork: Index of /wp-content/plugins/cp-polls/ # Exploit Author: Joaquin Ramirez Martinez [ i0akiN SEC-LABORATORY ] # Plugin URI: http://wordpress.dwbooster.com/forms/cp-polls # Version: 1.0.8 ============= Description ============= With **CP Polls** you can publish a poll into a page/post and optionally display statistics of the results. You can receive email notifications every time a vote is added or opt to receive Excel reports periodically. The Polls can have dependant questions, this means that some questions are displayed depending of the selection made on other questions. (copy of README.txt) =================== Technical details =================== CP Polls plugin for wordpress is vulnerable to Persistent Cross-site scripting is not sanitizing the values of the options before savinng to database. This issue can be exploited by an attacker with CSRF by sending a malicious link to a wordpress administrator. If administrator clicks the link, the action will be executed because there isn't CSRF protection. ========================= Proof of Concept (html) ========================= ========== CREDITS ========== Vulnerability discovered by: Joaquin Ramirez Martinez [i0 security-lab] joaquin.ramirez.mtz.lab[at]gmail[dot]com https://www.facebook.com/I0-security-lab-524954460988147/ https://www.youtube.com/channel/UCe1Ex2Y0wD71I_cet-Wsu7Q ======== TIMELINE ======== 2016-02-10 vulnerability discovered 2016-02-22 reported to vendor 2016-03-01 released cp polls v1.0.9 2016-03-01 public disclousure