Rahul Sreenivasan

**Name of the Vulnerable Software and Affected Versions** Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress versions through 10.3.1 **Description** The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is susceptible to time-based SQL Injection. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries, specifically affecting the `is linking` parameter. Authenticated attackers with Subscriber-level access or higher can exploit this to append additional SQL queries, potentially extracting sensitive information from the database. **Recommendations** Update Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress to a version later than 10.3.1.

**Name of the Vulnerable Software and Affected Versions** Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress versions prior to and including 10.3.1 **Description** The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is susceptible to unauthorized access and data modification. This is due to the absence of appropriate capability and status checks within multiple functions. This allows unauthenticated attackers to view details of unpublished, private, or password-protected quizzes. Attackers can also submit file responses to questions within these quizzes, enabling file upload functionality. The vulnerable functions lack proper authorization controls, allowing unauthorized access to sensitive quiz data and potential file uploads. **Recommendations** Update to a version beyond 10.3.1.

**Name of the Vulnerable Software and Affected Versions** Quiz Maker plugin for WordPress versions up to and including 6.7.0.56 **Description** The Quiz Maker plugin for WordPress is susceptible to SQL Injection via manipulated IP headers. This occurs due to inadequate escaping of user-supplied parameters and insufficient preparation of existing SQL queries. Unauthenticated attackers can inject additional SQL queries into existing queries, potentially extracting sensitive information from the database. This is exploitable in configurations where the server retrieves the IP address from a user-supplied field, such as the `X-Forwarded-For` header, and IP-based user restrictions are enabled. The vulnerable parameter is the value provided in the `X-Forwarded-For` header. **Recommendations** Versions prior to 6.7.0.57 should be updated. Disable IP-based user restrictions if the server is configured to retrieve the IP address from a user-supplied field like `X-Forwarded-For`.