PT-2017-11009 · WordPress · Surveyjs

Published 2017-09-14 · Updated 2017-09-19 · CVE-2017-1002020

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wordpress plugin surveys version 1.01.8

Description The issue arises from the code in survey form.php, which fails to sanitize the action variable before incorporating it into an SQL query. This lack of sanitization can lead to potential SQL injection issues.

Recommendations For version 1.01.8, ensure proper sanitization of the action variable in the survey form.php file to prevent SQL injection. Consider modifying the code to validate and cleanse user-input data before it is used in SQL queries.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-1002020

Affected Products

Surveyjs

References · 5

• 🔥 http://vapidlabs.com/advisory.php?v=193 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-1002020 · Security Note
• https://osv.dev/vulnerability/CVE-2017-1002020 · Vendor Advisory
• https://wpvulndb.com/vulnerabilities/8833 · Note
• https://wordpress.org/plugins/surveys · Note