CVE-2021-24456: Quiz Maker < 6.2.0.9 - Multiple Authenticated Blind SQL Injections
Published Aug 2, 2021
·Updated
The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard
Affected Software
1 affected component
ays-pro Quiz Maker Wordpress<6.2.0.9
Event History
Aug 2, 2021
CVE Published
via MITRE·10:32 AM
Data Sourced
via MITRE·10:32 AM
DescriptionWeakness
Frequently Asked Questions
1
What is CVE-2021-24456?
CVE-2021-24456 is a vulnerability in the Quiz Maker WordPress plugin that allows SQL injection issues in the admin dashboard.
2
How severe is CVE-2021-24456?
CVE-2021-24456 has a severity level of 7.2 (high).
3
How does CVE-2021-24456 affect the Quiz Maker WordPress plugin?
CVE-2021-24456 affects Quiz Maker WordPress plugin versions up to and exclusive of 6.2.0.9.
4
What is the Common Weakness Enumeration (CWE) ID associated with CVE-2021-24456?
The Common Weakness Enumeration (CWE) ID associated with CVE-2021-24456 is CWE-89 (SQL Injection).
5
Is there a fix available for CVE-2021-24456?
Yes, upgrading to version 6.2.0.9 or later of the Quiz Maker WordPress plugin fixes the vulnerability.