CVE-2024-10628

Published Jan 26, 2025

Last updated 2 months ago

WordPress

Quiz Maker

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2024-10628 affects the Quiz Maker Business, Developer, and Agency plugins for WordPress. It is present in versions up to and including 8.8.0 (Business), 21.8.0 (Developer), and 31.8.0 (Agency). The vulnerability is due to insufficient escaping of the 'id' parameter and a lack of sufficient preparation in the existing SQL query. This allows unauthenticated attackers to append additional SQL queries, potentially extracting sensitive information from the database.

Description: The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Source: security@wordfence.com
NVD status: Received

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Weaknesses

security@wordfence.com: CWE-89

Hype score: Not currently trending

Overview

AI description

Risk scores

CVSS 3.1

Weaknesses

Social media

References