Perfect Survey < 1.5.2 - Unauthenticated SQL Injection
82Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 87%
from disclosure to weapon20 days
Published on NVDFeb 1
1st PoC+20d
metasploitOct 5
VulnCheck+199d
exploitation probability
87%top 1% of all CVEs
observed exploitation
yesVulnCheck
5 public exploit(s)
The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection.
Affected products
Unknown · Perfect Surveypublic PoCs found — 5
exploitdbwww.exploit-db.com/exploits/50766unverifiedgithubgithub.com/c4cnm/Exploit_CVE-2021-24762★ 1githubgithub.com/NT1410/CVE-2021-24762★ 0cve_referencepacketstormsecurity.com/files/166072/WordPress-Perfect-Survey-1.5.1-SQL-Injection.htmlunverifiedvulncheckvulncheck.com/xdb/4433afc14c26unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.