• Summary
• Description
• PoC/ Exploit
• Solution

Description - Unauthorized Data Modification in Advanced Poll

Multiple Vulnerabilities found in Advanced Poll script.

Exploit

Available

Solution

Not available - check vendor's website

1. SQL Injection.

Vulnerable script: include/class_poll.php

UserAgent value from header of HTTP-query is not properly sanitized before being used in SQL query. This can be used to make some SQL queries by injecting arbitrary SQL code.

Condition: magic_quotes_gpc = off

2. Unauthorized Data Modification.

Vulnerable Script: include/class_poll.php

This attack would lead the coordinates to be spoofed and taken over by illegal Proxies. This is done, by checking if HTTP_X_FORWARDED_FOR exists and using this IP from HTTP_X_FORWARDED_FOR to identify unique voted person.

The attacker can send fake HTTP_X_FORWARDED_FOR values in http-headers as many as the attacker wants with different IP in HTTP_X_FORWARDED_FOR.