PT-2022-25351 · WordPress · Quiz/Survey Master

Andreas Krüger + 1 · Published 2022-11-29 · Updated 2022-12-02 · CVE-2022-4033

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Quiz and Survey Master plugin for WordPress versions up to, and including, 8.0.4

Description The issue is related to input validation bypass via the question[id] parameter. Insufficient input validation allows attackers to inject content other than the specified value, such as a number or file path, making it possible for attackers to submit values other than the intended input type.

Recommendations For versions up to, and including, 8.0.4, consider restricting the input for the question[id] parameter to prevent injection of unauthorized content until a patch is available. As a temporary workaround, ensure that all inputs are thoroughly validated to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2022-4033

Affected Products

Quiz/Survey Master

References · 8

• https://osv.dev/vulnerability/CVE-2022-4033 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2801761%40quiz-master-next&new=2801761%40quiz-master-next&sfp_email=&sfph_mail= · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-4033 · Security Note
• https://t.me/cvenotify/38924 · Telegram Post
• https://t.me/cvenotify/38719 · Telegram Post
• https://wordfence.com/vulnerability-advisories-continued/#CVE-2022-4033 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9f5cc779-c7de-42e6-a812-5c0539067b8c?source=cve · Note
• https://t.me/cibsecurity/53675 · Telegram Post