The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. While the result is not disclosed in the response, it is possible to use a timing attack to exfiltrate data such as password hash.
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/24f933b0-ad57-4ed3-817d-d637256e2fb1 | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: WPScan
Published: 2021-10-11T10:45:35
Updated: 2021-10-11T10:45:34
Reserved: 2021-01-14T00:00:00
Link: CVE-2021-24651
JSON object: View
NVD Information
Status : Analyzed
Published: 2021-10-11T11:15:08.907
Modified: 2022-11-09T21:49:24.167
Link: CVE-2021-24651
JSON object: View
Redhat Information
No data.