CVE-2009-4385 in Ez Poll Hoster
Summary
by MITRE
Multiple cross-site request forgery (CSRF) vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH) allow remote attackers to (1) hijack the authentication of arbitrary users for requests that delete polls via the delete_poll action to index.php; and hijack the authentication of administrators for requests that (2) delete users via the manage action to admin.php, or (3) send arbitrary email to arbitrary users in the email action to admin.php.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/11/2025
The vulnerability identified as CVE-2009-4385 represents a critical cross-site request forgery flaw within the Scriptsez.net Ez Poll Hoster (EPH) web application. This vulnerability resides in the authentication and authorization mechanisms of the application, specifically affecting the index.php and admin.php scripts that handle administrative and user management functions. The flaw allows remote attackers to exploit the lack of proper anti-CSRF token validation, enabling them to manipulate authenticated sessions and execute unauthorized actions against the vulnerable system.
The technical implementation of this vulnerability stems from the absence of anti-CSRF protection mechanisms within the application's request handling process. When users interact with the poll management features through index.php, or when administrators perform user management tasks through admin.php, the application fails to validate the authenticity of the requests. This omission creates a pathway for attackers to craft malicious requests that can be executed in the context of authenticated users, effectively bypassing the normal authentication checks that should prevent unauthorized access to administrative functions.
The operational impact of this vulnerability is severe and multifaceted, as it provides attackers with three distinct attack vectors for unauthorized system manipulation. The first vector allows attackers to delete polls by exploiting the delete_poll action in index.php, potentially causing data loss and disruption to poll services. The second vector targets administrators specifically, enabling them to delete users through the manage action in admin.php, which can result in account compromise and user data removal. The third vector permits sending arbitrary emails to any users through the email action in admin.php, which can be leveraged for spamming, phishing attacks, or social engineering campaigns. These combined attack vectors represent a comprehensive compromise of the application's security posture.
This vulnerability aligns with CWE-352, which specifically addresses Cross-Site Request Forgery, and maps to several ATT&CK techniques including T1566 for phishing and T1078 for valid accounts, as the attacks exploit legitimate user sessions to gain unauthorized access. The lack of proper input validation and session management creates an environment where attackers can manipulate the application's behavior through crafted HTTP requests. The vulnerability's exploitation requires minimal technical expertise and can be automated, making it particularly dangerous in environments where administrators may not be actively monitoring for such attacks.
The recommended mitigations for this vulnerability include implementing robust anti-CSRF token mechanisms that must be validated for each request, particularly for actions that modify system state or perform administrative functions. All forms and actions that modify data should require unique tokens that are tied to the user's session and validated server-side before processing. Additionally, implementing proper session management with secure cookie attributes, enforcing strict access controls, and implementing rate limiting for administrative actions would significantly reduce the attack surface. Regular security auditing and input validation should be implemented to prevent similar vulnerabilities from emerging in future versions of the application.
The broader implications of this vulnerability extend beyond the immediate application, as it demonstrates how insufficient attention to authentication and authorization controls can create cascading security risks. Organizations using similar polling or content management systems should conduct comprehensive security assessments to identify and remediate similar CSRF vulnerabilities. The vulnerability also highlights the importance of implementing defense-in-depth strategies, including network segmentation, monitoring for anomalous administrative activity, and regular security training for system administrators to recognize potential exploitation attempts.