PT-2017-11010 · WordPress · Surveyjs

Larry W. Cashdollar + 1 · Publicado 2017-09-14 · Atualizado 2017-09-18 · CVE-2017-1002021

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wordpress plugin surveys version 1.01.8

Description The issue arises from the code in individual responses.php, which fails to sanitize the survey id variable before using it in an SQL query.

Recommendations For version 1.01.8, ensure proper sanitization of the survey id variable in the individual responses.php file to prevent SQL injection attacks. As a temporary workaround, consider restricting access to the individual responses.php file until a proper fix is applied.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-1002021

Produtos afetados

Surveyjs

Referências · 5

• 🔥 http://vapidlabs.com/advisory.php?v=193 · Exploit
• https://osv.dev/vulnerability/CVE-2017-1002021 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1002021 · Nota de Segurança
• https://wpvulndb.com/vulnerabilities/8833 · Nota
• https://wordpress.org/plugins/surveys · Nota