Chained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 5.3epss 0.9%
da publicação à arma98 dias
Publicada no NVD18 de set.
1ª PoC+98d
probabilidade de exploração
0.9%top 45% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
The Chained Quiz plugin for WordPress is vulnerable to Insecure Direct Object Reference in version 1.3.4 and below via the quiz submission and completion mechanisms due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to hijack and modify other users' quiz attempts by manipulating the chained_completion_id cookie value, allowing them to alter quiz answers, scores, and results of any user. The vulnerability was partially patched in versions 1.3.4 and 1.3.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
prasunsen · Chained QuizPoCs públicas encontradas — 1
exploitdbwww.exploit-db.com/exploits/52464não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://plugins.trac.wordpress.org/browser/chained-quiz/tags/1.3.3/controllers/quizzes.phphttps://plugins.trac.wordpress.org/browser/chained-quiz/tags/1.3.3/models/quiz.phphttps://plugins.trac.wordpress.org/changeset/3362561/https://plugins.trac.wordpress.org/changeset/3362701/https://plugins.trac.wordpress.org/changeset/3362966/https://www.wordfence.com/threat-intel/vulnerabilities/id/1d8f6965-1fe3-4f24-bd6b-9026e91bc5db?source=cve