This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: A SQL Injection (SQLi) flaw in the **Perfect Survey** WordPress plugin. ๐ **Consequences**: Attackers can execute illegal SQL commands, potentially stealing data or taking over the admin account.โฆ
๐ก๏ธ **Root Cause**: **CWE-89** (SQL Injection). The plugin fails to validate or escape the `question_id` GET parameter before using it in a SQL statement within the `get_question` AJAX action.โฆ
๐ฏ **Affected**: **Perfect Survey WordPress plugin** versions **before 1.5.2**. ๐ฆ If you are running an older version, you are in the danger zone. WordPress itself is the platform, but the plugin is the weak link.
Q4What can hackers do? (Privileges/Data)
๐ **Attacker Capabilities**: Unauthenticated users can perform SQL injection. ๐ต๏ธโโ๏ธ Specifically, exploits can **grep the admin password** (Blind SQLi). This means full account takeover and potential database compromise.
Q5Is exploitation threshold high? (Auth/Config)
๐ **Exploitation Threshold**: **LOW**. No authentication is required! ๐ถโโ๏ธ Any unauthenticated user on the internet can trigger the vulnerability via the `question_id` parameter. Itโs an open door.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ฃ **Public Exploits**: **YES**. ๐ Multiple PoCs exist, including a specific Blind SQLi exploit repo (`c4cnm/Exploit_CVE-2021-24762`) designed to extract admin passwords. Tools like Nuclei templates are also available.
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: Scan for the **Perfect Survey** plugin version. ๐ ๏ธ Use scanners like **Nuclei** with the specific CVE template. Look for the `get_question` AJAX endpoint accepting unsanitized `question_id` parameters.
Q8Is it fixed officially? (Patch/Mitigation)
๐ฉน **Official Fix**: **YES**. Upgrade the Perfect Survey plugin to **version 1.5.2 or later**. ๐ฅ The vendor has released a patch that addresses the input validation issue. Update immediately!
Q9What if no patch? (Workaround)
๐ง **No Patch?**: If you can't update, **disable the plugin** immediately. ๐ Alternatively, implement strict WAF rules to block SQL injection patterns in the `question_id` parameter, though disabling is safer.
Q10Is it urgent? (Priority Suggestion)
โก **Urgency**: **HIGH**. ๐จ Since it allows **unauthenticated** access and leads to **admin password theft**, this is a critical threat. Patch now or risk total site compromise. Don't wait!