PT-2021-15982 · Unknown · The Quiz Maker

To Quang Duong · Published 2021-08-02 · Updated 2021-08-09 · CVE-2021-24456

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Quiz Maker versions prior to 6.2.0.9

Description The issue arises from improper sanitization and escaping of the order and orderby parameters before their use in SQL statements, leading to SQL injection issues in the admin dashboard.

Recommendations For versions prior to 6.2.0.9, update to version 6.2.0.9 or later to resolve the issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24456

Affected Products

The Quiz Maker

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-24456 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24456 · Vendor Advisory
• https://wpscan.com/vulnerability/929ad37d-9cdb-4117-8cd3-cf7130a7c9d4 · Note