CVE-2024-3592 – This SQL injection vulnerability in the Quiz An... (How to Fix)

Q: What is the severity of CVE-2024-3592?

CVE-2024-3592 has a CVSS score of 9.9 (CRITICAL). This SQL injection vulnerability in the Quiz And Survey Master WordPress plugin allows authenticated attackers with contributor-level access or higher to inject malicious SQL queries via the 'question_id' parameter. This can lead to unauthorized data extraction from the database, potentially exposing sensitive information. All WordPress sites using vulnerable versions of this plugin are affected.

📋 TL;DR

This SQL injection vulnerability in the Quiz And Survey Master WordPress plugin allows authenticated attackers with contributor-level access or higher to inject malicious SQL queries via the 'question_id' parameter. This can lead to unauthorized data extraction from the database, potentially exposing sensitive information. All WordPress sites using vulnerable versions of this plugin are affected.

💻 Affected Systems

Products:

Quiz And Survey Master WordPress Plugin

Versions: All versions up to and including 9.0.1

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated user with contributor-level access or higher. WordPress multisite installations are also affected.

📦 What is this software?

Quiz And Survey Master by Expresstech

View all CVEs affecting Quiz And Survey Master →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise including extraction of user credentials, personal data, and administrative access leading to site takeover.

🟠

Likely Case

Extraction of sensitive user data, plugin configuration information, and potentially WordPress user credentials.

🟢

If Mitigated

Limited impact if proper input validation and prepared statements are implemented, restricting data access to authorized users only.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but uses simple SQL injection techniques. The vulnerability is well-documented and easy to weaponize.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 9.0.2

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3097878/quiz-master-next/trunk/php/admin/options-page-questions-tab.php

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Quiz And Survey Master'. 4. Click 'Update Now' if available. 5. Alternatively, download version 9.0.2+ from WordPress repository and manually update.

🔧 Temporary Workarounds

Temporary Plugin Deactivation

all

Disable the vulnerable plugin until patching is possible

wp plugin deactivate quiz-master-next

WAF Rule Implementation

all

Add web application firewall rules to block SQL injection attempts on question_id parameter

🧯 If You Can't Patch

Restrict contributor-level access to trusted users only
Implement network segmentation to isolate WordPress installation from sensitive databases

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Quiz And Survey Master version. If version is 9.0.1 or lower, you are vulnerable.

Check Version:

wp plugin get quiz-master-next --field=version

Verify Fix Applied:

Verify plugin version is 9.0.2 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries in database logs
Multiple failed login attempts followed by successful contributor login
Unusual access patterns to options-page-questions-tab.php

Network Indicators:

HTTP POST requests with SQL injection patterns in question_id parameter
Unusual database connection patterns from WordPress server

SIEM Query:

source="wordpress_logs" AND ("question_id" AND ("UNION" OR "SELECT" OR "INSERT" OR "DELETE" OR "UPDATE" OR "--" OR "' OR '1'='1"))

📊 Metadata

CVE ID: CVE-2024-3592

CVSS v3 Score: 9.9 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-89

Published: June 7, 2024

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-3592, you might also want to check these: