PT-2017-11011 · WordPress · Surveyjs

Publicado 2017-09-14 · Atualizado 2017-09-18 · CVE-2017-1002022

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wordpress plugin surveys version 1.01.8

Description The issue arises from the code in questions.php, which fails to sanitize the survey variable before incorporating it into an SQL query. This lack of sanitization can lead to potential SQL injection issues.

Recommendations For version 1.01.8, consider updating the questions.php file to properly sanitize the survey variable before it is used in SQL queries to prevent potential SQL injection attacks.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-1002022

Produtos afetados

Surveyjs

Referências · 5

• 🔥 http://vapidlabs.com/advisory.php?v=193 · Exploit
• https://wpvulndb.com/vulnerabilities/8833 · Nota
• https://osv.dev/vulnerability/CVE-2017-1002022 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1002022 · Nota de Segurança
• https://wordpress.org/plugins/surveys · Nota