Exploit_CVE-2021-24762

exploitcve-2021-24762 이 저장소는 CVE-2021-24762에 대한 익스플로잇을 보여줍니다. 기본 구성에서 관리자admin 비밀번호를 추출하는 블라인드 SQL 인젝션Blind SQLi 익스플로잇입니다. 랩 실습 중 PerfectSurvey 플러그인이 설치된 WordPress 기반 환경에서 SQL 취약점에 막혔습니다. 제가 찾은 유일한 PoC는 sqlmap 기반이었고, 제가 작업 중이던 랩에서는 제대로 작동하지 않았습니다추가적인 문제가 많았습니다. 예: 애플리케이션이 404를 반환하거나, 타임아웃이 너무 크게...

CVE-2021-24762

The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the questionid GET parameter before using it in a SQL statement in the getquestion AJAX action, allowing unauthenticated users to perform SQL injection...

CVE-2021-24762

creationtimestamp| type| source ---|---|--- 2022-06-20 19:53:12+00:00| published-proof-of-concept| https://t.me/LeakingXTeam/20993 2022-06-20 19:53:12+00:00| published-proof-of-concept| https://t.me/spammerspacer/33792 2022-06-20 19:53:12+00:00| published-proof-of-concept|...

WordPress Perfect Survey Plugin - 1.5.1 - SQL injection (Unauthenticated) Exploit

Exploit Title: WordPress Plugin Perfect Survey - 1.5.1 - SQLi Unauthenticated Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://www.getperfectsurvey.com/ Software Link: https://web.archive.org/web/20210817031040/https://downloads.wordpress.org/plugin/perfect-survey.1.5.1.zip Version:...

WordPress Perfect Survey 1.5.1 SQL Injection

Exploit Title: WordPress Plugin Perfect Survey - 1.5.1 - SQLi Unauthenticated Date 18.02.2022 Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://www.getperfectsurvey.com/ Software Link:...

WordPress Plugin Perfect Survey - 1.5.1 - SQLi (Unauthenticated)

Exploit Title: WordPress Plugin Perfect Survey - 1.5.1 - SQLi Unauthenticated Date 18.02.2022 Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://www.getperfectsurvey.com/ Software Link:...

CVE-2021-24762

CVE-2021-24762 affects WordPress Perfect Survey plugin versions before 1.5.2. The get_question AJAX action does not validate/escape the question_id parameter, enabling unauthenticated SQL injection. Consequences can include unauthorized access to data and potential compromise of the database. Rem...

CVE-2021-24762 Perfect Survey < 1.5.2 - Unauthenticated SQL Injection

The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the questionid GET parameter before using it in a SQL statement in the getquestion AJAX action, allowing unauthenticated users to perform SQL injection...