CVE-2024-8625

HIGHNuclei

TS Poll – Survey, Versus Poll, Image Poll, Video Poll < 2.4.0 - Admin+ SQL Injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-8625 has a selected CVSS score of 7.2 (high); EIP currently links 1 Nuclei template.

Description

The TS Poll WordPress plugin before 2.4.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 21, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

TS Poll

Default status: unaffected

CVE ListBefore 2.4.0affected

ts_poll

Browse pollbytotalsoft / ts_poll

Default status: unknown

CVE ListBefore 2.4.0affected

Nuclei templates

1
ProjectDiscoveryHIGHWordPress TS Poll < 2.4.0 - SQL InjectionCVSS 7.2

WordPress TS Poll plugin < 2.4.0 contains a SQL injection caused by lack of sanitization and escaping of a parameter before using it in a SQL statement, letting attackers perform SQL injection attacks, exploit requires admin privileges.

Impact

Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion.

Remediation

Update to version 2.4.0 or later.

WeaknessesCWE-89
Authorsriteshs4hu
Template tagscvecve2024wordpresswp-pluginwpts-pollsqliauthenticated
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:total-soft:ts_poll:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/ab4d7065-4ea2-4233-9593-0f540f91f45e/ https://nvd.nist.gov/vuln/detail/CVE-2024-8625

Source: ProjectDiscovery

References

2