PT-2017-11010
CVE-2017-1002021
·
Published
2017-09-14
·
Updated
2017-09-18
Description by
CVSS 3.1
9.8
CriticalMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
wordpress plugin surveys version 1.01.8
Description
The issue arises from the code in individual responses.php, which fails to sanitize the
survey id variable before using it in an SQL query.Recommendations
For version 1.01.8, ensure proper sanitization of the
survey id variable in the individual responses.php file to prevent SQL injection attacks. As a temporary workaround, consider restricting access to the individual responses.php file until a proper fix is applied.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾