Unauthenticated IDOR in Quiz And Survey Master

Executive Summary

This vulnerability is an Unauthenticated Insecure Direct Object Reference (IDOR) flaw in the Quiz And Survey Master plugin versions up to and including 11.2.5. IDOR occurs when an application exposes direct references to internal objects, allowing unauthorized access without proper authentication or authorization checks.

Useful 0 Not Useful 0

Detection Guidance

To detect this IDOR vulnerability in Quiz And Survey Master <= 11.2.5, manually review application endpoints for direct object references without proper authorization checks. Test by manipulating object IDs in requests (e.g., changing user IDs in URLs or API calls) to see if unauthorized data is exposed. Use tools like Burp Suite or OWASP ZAP to intercept and modify requests.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to access sensitive data or functionality without authentication. This may lead to unauthorized viewing or modification of quiz results, survey responses, or other protected content stored by the plugin.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties, fines, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Quiz And Survey Master to the latest version (11.2.6 or higher) to patch the IDOR flaw. If an update is unavailable, implement strict input validation and enforce authorization checks for all object references. Disable direct object access in favor of indirect references (e.g., using tokens instead of IDs).

Useful 0 Not Useful 0