CVE-2019-14231 - An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress

Back Back to CVE browser

CRITICAL

An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress

Published Jul 21, 2019

9.8

CRITICAL

CVSS 3.0

EPSS 4.62%

Description

An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress. One could exploit the points parameter in the ob_get_results ajax nopriv handler due to there being no sanitization prior to use in a SQL query in getResultByPointsTrivia. This allows an unauthenticated/unprivileged user to perform a SQL injection attack capable of remote code execution and information disclosure.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

http://www.openwall.com/lists/oss-security/2019/07/23/1
mailing-listx_refsource_MLISTExploitMailing ListThird Party Advisory
https://www.openwall.com/lists/oss-security/2019/07/21/1
x_refsource_MISCExploitMailing ListThird Party Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2019/07/23/1		mailing-listx_refsource_MLISTExploitMailing ListThird Party Advisory
https://www.openwall.com/lists/oss-security/2019/07/21/1		x_refsource_MISCExploitMailing ListThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jul 21, 2019

Updated Aug 5, 2024

Reserved Jul 21, 2019

Link CVE-2019-14231

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-14231

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-14231