Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for: SQL injection
Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
- Component
- Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for
- Plugin slug
quiz-and-survey-master- Affected
- See vendor advisory
- Safe version
- See mitigation notes
- Published
- Apr 12, 2021
This CVE was published Apr 12, 2021 and is one of 17 known issues for this plugin.
Update, patch or deactivate.
Update Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for to a release outside the affected range, or disable and remove it until a fixed version is available.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attribute, concatenating it in a SQL statement and leading to an SQL injection. The lowest role allowed to use this shortcode in post or pages being author, such user could gain unauthorised access to the DBMS. If the shortcode (without the id attribute) is embed on a public page or post, then unauthenticated users could exploit the injection.
NVD vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H