Quiz Master Next WordPress Plugin SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Quiz Master Next WordPress plugin, affecting versions through 11.2.0. The issue arises from inadequate escaping of the user-supplied 'pages' parameter in the qsm_ajax_save_pages() AJAX handler, which only applies basic sanitization. Additionally, the SQL query in qsm_options_questions_tab_content() at line 143 fails to properly prepare the interpolated page IDs before executing the query. This vulnerability allows authenticated attackers with Author-level access or higher to inject SQL payloads that are executed second-order when the quiz's Questions tab is viewed, potentially leading to unauthorized access to sensitive database information.

Impact

Exploitation of this vulnerability allows for authenticated SQL injection, where attackers can manipulate SQL queries to extract sensitive information from the database.

Reproduction

To reproduce this vulnerability, an authenticated user with Author-level access or higher can inject a SQL payload through the 'pages' parameter via the qsm_ajax_save_pages() AJAX handler. The injected SQL is executed when any user views the quiz's Questions tab, allowing the attacker to append additional SQL queries to the existing ones.

Remediation

Users are advised to update the Quiz Master Next WordPress plugin to version 11.2.1 or a newer patched version.