CVE-2021-24762

This repository contains a functional Python exploit for CVE-2021-24762, a blind SQL injection vulnerability in the WordPress Perfect Survey plugin. The exploit uses time-based SQLi with SLEEP to extract the admin password hash from the default WordPress database structure.

This repository documents a penetration testing lab targeting CVE-2021-24762, a SQL injection vulnerability in the Perfect Survey WordPress plugin. It includes detailed steps for reconnaissance, scanning, and exploitation using tools like Nuclei, SQLMap, and Dirsearch, but lacks actual exploit code.

This exploit demonstrates an unauthenticated SQL injection vulnerability in the WordPress Perfect Survey plugin (versions < 1.5.2) by leveraging the 'question_id' GET parameter in the 'get_question' AJAX action. It uses sqlmap to automate the exploitation process.

This Metasploit module exploits an unauthenticated SQL injection vulnerability in the WordPress Perfect Survey plugin (version 1.5.1) to extract sensitive user data, including usernames, emails, and password hashes from the `wp_users` table.