CVE-2017-1002022 - Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside of an SQL query

Back Back to CVE browser

CRITICAL

Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside of an SQL query

Published Sep 14, 2017

9.8

CRITICAL

CVSS 3.0

EPSS 3.63%

Description

Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside of an SQL query.

Affected products

Vendor Binny V A Product Surveys Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <1.01.8

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Binny V A

Surveys

n/a

Version	Status	Constraints
unspecified	affected	<1.01.8

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (4)

http://www.vapidlabs.com/advisory.php?v=193
x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-1637
Advisory
https://wordpress.org/plugins/surveys/
x_refsource_MISCThird Party Advisory
https://wpvulndb.com/vulnerabilities/8833
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
http://www.vapidlabs.com/advisory.php?v=193		x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-1637		Advisory
https://wordpress.org/plugins/surveys/		x_refsource_MISCThird Party Advisory
https://wpvulndb.com/vulnerabilities/8833		x_refsource_MISCThird Party Advisory