CVE-2021-24221CWE-89

Quiz And Survey Master < 7.1.12 - Authenticated SQL injection via shortcode

published April 12, 2021

CVSS
—
EPSS
2%
Percentile
79.4
In the wild
Unconfirmed
What it is

The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attribute, concatenating it in a SQL statement and leading to an SQL injection. The lowest role allowed to use this shortcode in post or pages being author, such user could gain unauthorised access to the DBMS. If the shortcode (without the id attribute) is embed on a public page or post, then unauthenticated users could exploit the injection.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01893 · 79.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2021-04-12T14:03Z
EPSS history
Timeline
  • 12 APR 14:03Z
    Quiz And Survey Master < 7.1.12 - Authenticated SQL injection via shortcode
    cvelistv5