CVE-2017-20257

Name of the Vulnerable Software and Affected Versions Quiz Deluxe version 3.7.4

Description An SQL injection allows unauthenticated attackers to execute arbitrary SQL commands through the 'ajaxaction.flag question' task. Attackers can inject malicious SQL code via the stu quiz id or flag quest parameters to manipulate database queries and extract sensitive information. SQL injection is a type of flaw that allows an attacker to interfere with the queries that an application makes to its database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.