CVE-2021-24483: Poll Maker < 3.2.1 - Authenticated Blind SQL Injections
The getpollcategories(), getpolls() and getreports() functions in the Poll Maker WordPress plugin before 3.2.1 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults() DB calls, leading to SQL injection issues in the admin dashboard
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2021-24483.
What is the severity of CVE-2021-24483?
The severity of CVE-2021-24483 is high with a severity value of 7.2.
Which functions in the Poll Maker WordPress plugin are affected by this vulnerability?
The get_poll_categories(), get_polls(), and get_reports() functions in the Poll Maker WordPress plugin before version 3.2.1 are affected by this vulnerability.
What is the impact of this vulnerability?
This vulnerability can lead to SQL injection issues in the admin dashboard of the Poll Maker WordPress plugin.
How can I fix CVE-2021-24483?
To fix CVE-2021-24483, you should update the Poll Maker WordPress plugin to version 3.2.1 or later.