CVE-2024-3592: 
WordPress vulnerability analysis and mitigation

The Quiz And Survey Master WordPress plugin (versions up to 9.0.1) contains a SQL Injection vulnerability identified as CVE-2024-3592. The vulnerability was discovered in June 2024 and affects the 'question_id' parameter due to insufficient escaping of user-supplied input and inadequate SQL query preparation (NVD).

The vulnerability is classified as SQL Injection (CWE-89) and received varying CVSS v3.1 scores: 6.5 (MEDIUM) from NIST with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, and 9.9 (CRITICAL) from Wordfence with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The issue stems from insufficient parameter escaping in the question_id parameter (NVD).

The vulnerability allows authenticated attackers with contributor-level access or higher to append additional SQL queries to existing ones, potentially leading to the extraction of sensitive information from the database (NVD).

The vulnerability requires authentication with at least contributor-level access to exploit. The attack vector is network-accessible with low attack complexity, requiring no user interaction (NVD).

A patch has been released in version 9.0.2 of the Quiz And Survey Master plugin. Users are advised to update to this version or later to address the vulnerability (Wordpress Patch).