« Volver al listado

CVE-2017-1002021

Estado: ModificadaCrítica (9.8)—

Vulnerability in wordpress plugin surveys v1.01.8, The code in individual_responses.php does not sanitize the survey_id variable before placing it inside of an SQL query.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Surveys Project — Surveys

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-1002021",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "larry0@me.com",
      "affectedData": [
        {
          "vendor": "Binny V A",
          "product": "surveys",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "1.01.8",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-09-14T13:29:00.950",
  "references": [
    {
      "url": "http://www.vapidlabs.com/advisory.php?v=193",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "larry0@me.com"
    },
    {
      "url": "https://wordpress.org/plugins/surveys/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "larry0@me.com"
    },
    {
      "url": "https://wpvulndb.com/vulnerabilities/8833",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "larry0@me.com"
    },
    {
      "url": "http://www.vapidlabs.com/advisory.php?v=193",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wordpress.org/plugins/surveys/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wpvulndb.com/vulnerabilities/8833",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in wordpress plugin surveys v1.01.8, The code in individual_responses.php does not sanitize the survey_id variable before placing it inside of an SQL query."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad en el plugin surveys v1.01.8 en WordPress. El código en individual_responses.php no sanitiza la variable survey_id antes de incluirla dentro de una consulta SQL."
    }
  ],
  "lastModified": "2026-06-17T00:59:21.330",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:surveys_project:surveys:1.01.8:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "11A73A23-A10A-4B00-835F-0D0E200871BD"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "larry0@me.com"
}