CVE-2015-10111 (published 2023-06-04T12:15Z)

A vulnerability was found in Watu Quiz Plugin up to 2.6.7 on WordPress. It has been rated as critical. This issue affects the function watu_exams of the file controllers/exam.php of the component Exam Handler. The manipulation of the argument quiz leads to sql injection. The attack may be initiated remotely. Upgrading to version 2.6.8 is able to address this issue. The patch is named bf42e7cfd819a3e76cf3e1465697e89f4830590c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230651.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/wp-plugins/watu
commit_details: repo_url: https://github.com/wp-plugins/watu
author: prasunsen
author_date: 2015-11-20 17:33:01+00:00
msg: Fixed security exploit

git-svn-id: https://plugins.svn.wordpress.org/watu/trunk@1290960 b8457f37-d9ea-0310-8a92-e5e31aec5664
repository: repo_url: https://github.com/wp-plugins/watu
repo_name: wp-plugins/watu
description: WordPress.org Plugin Mirror
repo_language: PHP
owner: wp-plugins
file_changes: filename: exam.php
change_type: ModificationType.MODIFY
diff: @@ -7,9 +7,9 @@ function watu_exams() {
 	if( isset($_REQUEST['grade']) )  print '<div id="message" class="updated fade"><p>' . $_REQUEST['grade']. '</p></div>';
 	
 	if(!empty($_GET['action']) and $_GET['action'] == 'delete') {
-		$wpdb->get_results("DELETE FROM ".WATU_EXAMS." WHERE ID='$_REQUEST[quiz]'");
-		$wpdb->get_results("DELETE FROM ".WATU_ANSWERS." WHERE question_id IN (SELECT ID FROM ".WATU_QUESTIONS." WHERE exam_id='$_REQUEST[quiz]')");
-		$wpdb->get_results("DELETE FROM ".WATU_QUESTIONS." WHERE exam_id='$_REQUEST[quiz]'");
+		$wpdb->get_results($wpdb->prepare("DELETE FROM ".WATU_EXAMS." WHERE ID=%d", $_REQUEST['quiz']));
+		$wpdb->get_results($wpdb->prepare("DELETE FROM ".WATU_ANSWERS." WHERE question_id IN (SELECT ID FROM ".WATU_QUESTIONS." WHERE exam_id=%d", $_REQUEST['quiz']));
+		$wpdb->get_results($wpdb->prepare("DELETE FROM ".WATU_QUESTIONS." WHERE exam_id=%d", $_REQUEST['quiz']));
 		print '<div id="message" class="updated fade"><p>' . __('Test deleted', 'watu') . '</p></div>';
 	}
 	

programming_language: PHP
filename: show_exam.php
change_type: ModificationType.MODIFY
diff: @@ -196,7 +196,7 @@ if(isset($_REQUEST['do']) and $_REQUEST['do']) { // Quiz Reuslts.
 		if(empty($taking_id)) {
 			$wpdb->query($wpdb->prepare("INSERT INTO ".WATU_TAKINGS." SET exam_id=%d, user_id=%d, ip=%s, date=CURDATE(), 
 				points=%d, grade_id=%d, result=%s, snapshot='', start_time=%s", 
-				$exam_id, $uid, $_SERVER['REMOTE_ADDR'], $achieved, $g_id, $grade, $_POST['start_time']));
+				$exam_id, $uid, $_SERVER['REMOTE_ADDR'], $achieved, $g_id, $grade, @$_POST['start_time']));
 			$taking_id = $wpdb->insert_id;
 		}
 	}

programming_language: PHP
filename: readme.txt
change_type: ModificationType.MODIFY
diff: @@ -126,7 +126,7 @@ Yes. You can create a folder called "watu" under your active WP theme folder. Th
 
 == Changelog ==
 
-= Changes in 2.6.7 =
+= Changes in 2.6.8 =
 - Added option to limit the number of logged in user attempts for quizzes that require login.
 - You can specify one or more email addresses that will receive user's results (instead of just using the admin email from your WP Settings page)
 - You can now specify different content for the email sent to you when someone takes a quiz
@@ -134,6 +134,7 @@ Yes. You can create a folder called "watu" under your active WP theme folder. Th
 - You can specify different email contents of the email sent to user than the contents of the email sent to admin
 - All views /  templates can now be overriden by placing their copy under a folder called "watu" in your theme folder.
 - Added option to switch off Ajax submitting for certain quizzes. This is useful if you are embedding javascript via shortcodes from other plugins in the final screen of the quiz as some javascripts won't work when loaded by Ajax.
+- Fixed security exploit
 
 = Changes in 2.6 =
 - Added optional text-based "captcha" to prevent spam bot submissions on quizzes which do not require user login

programming_language: Markdown
filename: script.js
change_type: ModificationType.MODIFY
diff: @@ -179,6 +179,7 @@ Watu.submitResult = function(e) {
 	}
 	
 	data['post_id'] = Watu.post_id;
+	data['start_time'] = jQuery('#watuStartTime').val();
 	
 	// no ajax? In this case only return true to allow submitting the form	
 	if(e && e.no_ajax && e.no_ajax.value == 1) return true;	

programming_language: JavaScript
filename: show_exam.html.php
change_type: ModificationType.MODIFY
diff: @@ -71,7 +71,7 @@ if($single_page != 1 and $answer_display!=2): ?>
 <input type="hidden" name="post_id" value="<?php echo $post->ID?>">
 <?php endif; // end if(!empty($exam->no_ajax))?>
 <input type="hidden" name="quiz_id" value="<?php echo $exam_id ?>" />
-<input type="hidden" name="start_time" value="<?php echo current_time('mysql'); ?>" />
+<input type="hidden" id="watuStartTime" name="start_time" value="<?php echo current_time('mysql'); ?>" />
 </form>
 </div>
 <script type="text/javascript">

programming_language: PHP
filename: watu.php
change_type: ModificationType.MODIFY
diff: @@ -4,7 +4,7 @@ Plugin Name: Watu
 Plugin URI: http://calendarscripts.info/watu-wordpress.html
 Description: Create exams and quizzes and display the result immediately after the user takes the exam. Watu for Wordpress is a light version of <a href="http://calendarscripts.info/watupro/" target="_blank">WatuPRO</a>. Check it if you want to run fully featured exams with data exports, student logins, timers, random questions and more. Free support and upgrades are available. Go to <a href="options-general.php?page=watu.php">Watu Settings</a> or <a href="tools.php?page=watu_exams">Manage Your Exams</a> 
 
-Version: 2.6.7
+Version: 2.6.8
 Author: Kiboko Labs
 License: GPLv2 or later
 
@@ -326,7 +326,7 @@ function watu_vc_scripts() {
 			'watu-script',
 			WATU_URL.'script.js',
 			array(),
-			'2.3.2'
+			'2.3.3'
 		);
 		
 		$translation_array = array(

programming_language: PHP