CVE-2020-35951

CRITICALNuclei

Wordpress Quiz and Survey Master <7.0.1 - Arbitrary File Deletion

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2020-35951 has a selected CVSS score of 9.9 (critical); EIP currently links 1 Nuclei template.

Description

An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files).

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryCRITICALWordpress Quiz and Survey Master <7.0.1 - Arbitrary File DeletionCVSS 9.9

Wordpress Quiz and Survey Master <7.0.1 allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files).

Impact

This vulnerability can lead to unauthorized deletion of critical files, resulting in data loss or server compromise.

Remediation

Upgrade to the latest version of Wordpress Quiz and Survey Master plugin (7.0.1 or higher) to mitigate this vulnerability.

WeaknessesCWE-306
Authorsprincechaddha
Template tagscvecve2020wordpresswp-pluginwpscanintrusiveexpresstechvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
CPE: cpe:2.3:a:expresstech:quiz_and_survey_master:*:*:*:*:*:wordpress:*:*
https://www.wordfence.com/blog/2020/08/critical-vulnerabilities-patched-in-quiz-and-survey-master-plugin/ https://nvd.nist.gov/vuln/detail/CVE-2020-35951 https://wpscan.com/vulnerability/10348

Source: ProjectDiscovery

References

3