CVE-2021-36898 : Security Advisory and Response

WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. SQL Injection (SQLi) vulnerability was published on October 21, 2022, by Patchstack. The vulnerability impacts Quiz And Survey Master plugin version <= 7.3.4 on WordPress.

Understanding CVE-2021-36898

Auth. SQL Injection (SQLi) vulnerability in Quiz And Survey Master plugin <= 7.3.4 on WordPress.

What is CVE-2021-36898?

CVE-2021-36898 is a critical Authenticated SQL Injection (SQLi) vulnerability found in the Quiz And Survey Master plugin with version <= 7.3.4 on WordPress.

The Impact of CVE-2021-36898

The vulnerability poses a high risk, allowing attackers with high privileges to execute malicious SQL injection attacks, leading to potential data theft, manipulation, or unauthorized actions.

Technical Details of CVE-2021-36898

The vulnerability discovered by Vlad Vector (Patchstack) has a CVSS v3.1 base score of 9.1, indicating a critical severity level. The attack complexity is low, but high privileges are required, and the impact on confidentiality, integrity, and availability is all rated as high.

Vulnerability Description

The vulnerability is classified as CWE-89 SQL Injection, enabling threat actors to perform SQL injection attacks by exploiting the Plugin's security gap.

Affected Systems and Versions

Vendor: ExpressTech
Product: Quiz And Survey Master (WordPress plugin)
Versions Affected: <= 7.3.4

Exploitation Mechanism

Attackers with high privileges can exploit the vulnerability through authenticated SQL injection attacks against the affected plugin version.

Mitigation and Prevention

To mitigate the risks associated with CVE-2021-36898, users are advised to take immediate action and follow long-term security practices.

Immediate Steps to Take

Users should update the Quiz And Survey Master plugin to version 7.3.5 or higher immediately to eliminate the vulnerability.

Long-Term Security Practices

Regularly update WordPress plugins, maintain strict access controls, conduct security audits, and monitor for any suspicious activities to enhance overall security posture.

Patching and Updates

Stay informed about security updates and patches released by the vendor, apply them promptly to ensure the system's protection.