← back
CVE-2015-2090

CVE-2015-2090

EPSS 4.7%
SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows remote attackers to execute arbitrary SQL commands via the survey_id parameter in an ajax_survey action to wp-admin/admin-ajax.php.
Affected products
n/a · n/a
public PoCs found — 3
cve_referencepacketstormsecurity.com/files/130381/WordPress-Survey-And-Poll-1.1.7-Blind-SQL-Injection.htmlunverifiedcve_referencewww.exploit-db.com/exploits/36054unverifiedexploitdbwww.exploit-db.com/exploits/36054unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://osvdb.org/show/osvdb/118218http://packetstormsecurity.com/files/130381/WordPress-Survey-And-Poll-1.1.7-Blind-SQL-Injection.htmlhttps://wordpress.org/plugins/wp-survey-and-poll/changelog/http://www.exploit-db.com/exploits/36054http://www.securityfocus.com/bid/74890