Exploitation Summary
EIP tracks 1 public exploit for CVE-2009-4385. PoCs published by Milos Zivanovic.
AI-analyzed exploit summary This exploit demonstrates multiple XSS and XSRF vulnerabilities in Ez Poll Hoster, including proof-of-concept URLs and a form-based exploit for sending arbitrary emails to all users. The vulnerabilities allow for cross-site scripting and cross-site request forgery attacks.
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH) allow remote attackers to (1) hijack the authentication of arbitrary users for requests that delete polls via the delete_poll action to index.php; and hijack the authentication of administrators for requests that (2) delete users via the manage action to admin.php, or (3) send arbitrary email to arbitrary users in the email action to admin.php.
Exploits (1)
This exploit demonstrates multiple XSS and XSRF vulnerabilities in Ez Poll Hoster, including proof-of-concept URLs and a form-based exploit for sending arbitrary emails to all users. The vulnerabilities allow for cross-site scripting and cross-site request forgery attacks.