Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress, ee90f784-f17b-4268-9443-8f29e58d2ee1
- CVE, Research URL
- Home page URL
-
Security reports for Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress
- Published on
- -
- Research Description
- Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next] < 7.1.14 Quiz And Survey Master < 7.1.14 - Authenticated SQL injection via Rest API While confirming https://wpscan.com/vulnerability/3b52b25c-82a1-41c7-83ac-92e244f7c5ab, another SQLi issue was identified and reported. The qsm_rest_get_bank_questions() function in the php/rest-api.php file did not property sanitise and escape the category parameter before using it in SQL statements passed to the get_row() and get_results() DB calls, allowing users with the edit_post capability (author+) to perform SQL injections. Other SQLi issues were also identified by the WordPress plugin team
- Affected versions
-
max 7.1.14.
- Status
-
vulnerable