CVE-2024-6028: Quiz Maker WordPress Plugin SQLi Flaw

CVE-2024-6028 Overview

The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ays_questions parameter in all versions up to, and including, 6.5.8.3 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This vulnerability allows unauthenticated attackers to append additional SQL queries into existing queries, potentially extracting sensitive information from the database.

Critical Impact
This vulnerability can lead to unauthorized access to sensitive information and data corruption, with a CVSS score of 9.8.

Affected Products

The Quiz Maker plugin for WordPress up to version 6.5.8.3

Discovery Timeline

2024-06-25 - CVE CVE-2024-6028 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-6028

Vulnerability Analysis

This time-based SQL injection vulnerability stems from improper input sanitization and insufficient SQL query preparation within the Quiz Maker plugin. The failure to sanitize user inputs allows attackers to inject malicious SQL statements through the vulnerable parameter, gaining remote access to extract sensitive database information.

Root Cause

The root cause of the vulnerability is the insufficient escaping and dynamic construction of SQL queries using the ays_questions parameter in the Quiz Maker plugin.

Attack Vector

Attackers can exploit this vulnerability by sending crafted HTTP requests to the target WordPress site with manipulated ays_questions parameters via network access.

sql

-- Example exploitation code (sanitized)
SELECT * FROM quizzes WHERE question_id = '1' OR SLEEP(5); --'

Detection Methods for CVE-2024-6028

Indicators of Compromise

Unusual database query logs
Unexpected delays in processing SQL queries
Unauthorized data access logs

Detection Strategies

Utilize a combination of web application firewalls and SQL query logging to monitor and flag anomalous query patterns. Implement SQL query analysis to detect time delay patterns inherent to time-based SQL Injection.

Monitoring Recommendations

Enable verbose logging for database queries and application access to track parameter-based SQL anomalies. Use behavior analytics to identify patterns of exploitation.

How to Mitigate CVE-2024-6028

Immediate Actions Required

Update the Quiz Maker plugin to the latest patched version
Implement input sanitization for all incoming data
Employ parameterized queries to safeguard SQL statements

Patch Information

The vendor has released patches in version 6.5.8.4 to address this vulnerability. Users are encouraged to update immediately.

Workarounds

Use a web application firewall to block malicious requests targeting the ays_questions parameter. Ensure database permissions are restricted and regular security audits are conducted.

bash

# Configuration example
echo "Setting up WAF rules"
iptables -A INPUT -p tcp --dport 80 -m string --string 'ays_questions' --algo bm -j DROP