CVE-2021-24762
CRITICAL EXPLOITED IN THE WILD NUCLEIThe Perfect Survey WP <1.5.2 - SQL Injection
Title source: llmExploitation Summary
CVE-2021-24762 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).
EIP tracks 4 public exploits from researchers including Ron Jost, NT1410, c4cnm, including a Metasploit module auxiliary/scanner/http/wp_perfect_survey_sqli.
A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit demonstrates an unauthenticated SQL injection vulnerability in the WordPress Perfect Survey plugin (versions < 1.5.2) by leveraging the 'question_id' GET parameter in the 'get_question' AJAX action. It uses sqlmap to automate the exploitation process.
Description
The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection.
Exploits (4)
This exploit demonstrates an unauthenticated SQL injection vulnerability in the WordPress Perfect Survey plugin (versions < 1.5.2) by leveraging the 'question_id' GET parameter in the 'get_question' AJAX action. It uses sqlmap to automate the exploitation process.
This repository documents a penetration testing lab targeting CVE-2021-24762, a SQL injection vulnerability in the Perfect Survey WordPress plugin. It includes detailed steps for reconnaissance, scanning, and exploitation using tools like Nuclei, SQLMap, and Dirsearch, but lacks actual exploit code.
This repository contains a functional Python exploit for CVE-2021-24762, a blind SQL injection vulnerability in the WordPress Perfect Survey plugin. The exploit uses time-based SQLi with SLEEP to extract the admin password hash from the default WordPress database structure.
This Metasploit module exploits an unauthenticated SQL injection vulnerability in the WordPress Perfect Survey plugin (version 1.5.1) to extract sensitive user data, including usernames, emails, and password hashes from the `wp_users` table.
Nuclei Templates (1)
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H