Vulnerability · Published Jul 12, 2021 · Assigned by WPScan
CVE-2021-24442Poll, Survey, Questionnaire and Voting system < 1.5.3 - Unauthenticated Blind SQL Injection
Critical 9.8
In plain English
A critical-severity SQL injection in Poll, Survey, Questionnaire and Voting system from wpdevart. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 46.0% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)46.0%top 1.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the date_answers[] POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wpdevart | Poll, Survey, Questionnaire and Voting system | 1.5.3 – before 1.5.3 |
Weakness: CWE-89
References
- https://wpscan.com/vulnerability/7376666e-9b2a-4239-b11f-8544435b444a x_refsource_CONFIRM
- https://www.in-spired.xyz/wpdevart-polls-blind-sql-injection/ x_refsource_MISC