PT-2017-11009 · WordPress · Surveyjs

Publicado 2017-09-14 · Atualizado 2017-09-19 · CVE-2017-1002020

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wordpress plugin surveys version 1.01.8

Description The issue arises from the code in survey form.php, which fails to sanitize the action variable before incorporating it into an SQL query. This lack of sanitization can lead to potential SQL injection issues.

Recommendations For version 1.01.8, ensure proper sanitization of the action variable in the survey form.php file to prevent SQL injection. Consider modifying the code to validate and cleanse user-input data before it is used in SQL queries.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-1002020

Produtos afetados

Surveyjs

Referências · 5

• 🔥 http://vapidlabs.com/advisory.php?v=193 · Exploit
• https://wpvulndb.com/vulnerabilities/8833 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-1002020 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-1002020 · Aviso do Fabricante
• https://wordpress.org/plugins/surveys · Nota