Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-24762

Perfect Survey < 1.5.2 - Unauthenticated SQL Injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Perfect Survey

  • 1.5.2 to < 1.5.2affected

References