CVE-2021-24221: SQL Injection
First published: Mon Apr 12 2021(Updated: )
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attribute, concatenating it in a SQL statement and leading to an SQL injection. The lowest role allowed to use this shortcode in post or pages being author, such user could gain unauthorised access to the DBMS. If the shortcode (without the id attribute) is embed on a public page or post, then unauthenticated users could exploit the injection.
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Expresstech Quiz And Survey Master | <7.1.12 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-24221?
CVE-2021-24221 is a vulnerability in the Quiz And Survey Master plugin for WordPress that allows for SQL injection.
What is the severity of CVE-2021-24221?
CVE-2021-24221 has a severity rating of 8.8 (high).
How does CVE-2021-24221 occur?
CVE-2021-24221 occurs due to the failure to safely sanitize the result_id GET parameter in certain shortcode usages, leading to an SQL injection vulnerability.
What is the affected software?
The affected software is Quiz And Survey Master plugin for WordPress version up to 7.1.12.
How can I fix CVE-2021-24221?
To fix CVE-2021-24221, update the Quiz And Survey Master plugin to version 7.1.12 or higher.
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/tags
- agent/type
- agent/description
- agent/event
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- vendor/expresstech
- canonical/expresstech quiz and survey master