WordPress Plugin YOP Polls 6.2.7 – Stored Cross Site Scripting (XSS)

• Exploit Database
• 124 阅读

• 作者： Toby Jackson
  日期： 2021-06-28
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50066/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57

  # Exploit Title: WordPress Plugin YOP Polls 6.2.7 - Stored Cross Site Scripting (XSS) # Date: 09/06/2021 # Exploit Author: inspired - Toby Jackson # Vendor Homepage: https://yop-poll.com/ # Blog Post: https://www.in-spired.xyz/discovering-wordpress-plugin-yop-polls-v6-2-7-stored-xss/ # Software Link: https://en-gb.wordpress.org/plugins/yop-poll/ # Version: Tested on version 6.2.7 (Older versions may be affected) # Tested on: WordPress # Category : Webapps   ## I. Vulnerability   Stored Cross Site Scripting (XSS)   ## II. Product Overview   The software allows users to quickly generate polls and voting systems for their blog posts without any need for programming knowledge.   ## III. Exploit   When a poll is created that allows other answers and then the setting is enabled for displaying the other responses after submission, the other answer is not sanitized when displayed back to the user, showing an XSS vulnerability. It is, however, correctly sanitized when displaying the other choices on the initial vote page.   ## IV. Vulnerable Code   The vulnerable code resides in the fact the results are echoed back to the user without any sanitization performed on the output. It also gets stored in the database as it&apos;s inserts.   ## IV. Proof of Concept   - Create a new poll that allows other answers, with the results of the other answers being displayed after voting. - Set the permissions to whoever you&apos;d like to be able to vote. - Place it on a blog post. - Insert &apos;<script>alert(&apos;xss&apos;)</script>&apos; into the other box. - Submit vote. The payload gets triggered when reflected back to users. - Whenever a new user votes, they will also be affected by the payload.   ## VI. Impact   An attacker can leave stored javascript payloads to be executed whenever a user votes and views the results screen. This could lead to them stealing cookies, logging keystrokes and even stealing passwords from autocomplete forms.   ## VII. SYSTEMS AFFECTED   WordPress websites running "YOP Polls" plugin version 6.2.7 (older versions may also be affected).   ## VIII. REMEDIATION   Update the plugin to v6.2.8.   ## VIIII. DISCLOSURE TIMELINE ------------------------- June 9, 2021 1: Vulnerability identified. June 9, 2021 2: Informed developer of the vulnerability. June 10, 2021 1: Vendor requested proof of concept. June 10, 2021 2: Sent proof of concept and accompanying details. June 14, 2021 1: Vendor emails to state the vulnerability has been fixed. June 16, 2021 1: Confirmed fix, vendor happy to disclose the vulnerability. June 17, 2021 1: Requested CVE Number.