CVE-2021-24221
Quiz And Survey Master < 7.1.12 - Authenticated SQL injection via shortcode
- State
- Published
- Severity
- Not scored
- Published
- Apr 12, 2021
- Updated
- Aug 3, 2024
- Reserved
- Jan 14, 2021
Description
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attribute, concatenating it in a SQL statement and leading to an SQL injection. The lowest role allowed to use this shortcode in post or pages being author, such user could gain unauthorised access to the DBMS. If the shortcode (without the id attribute) is embed on a public page or post, then unauthenticated users could exploit the injection.
Scores
The record has no CVSS score.
Weaknesses
- CWE-89 SQL Injection
Affected Products
| Product | Versions |
|---|---|
Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPressUnknown |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.