CVE-2021-24183 — SQL Injection in Tutor LMS

CWE-89 — SQL Injection4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
7.6%
top 8.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Themeum Tutor LMS
Timeline
PublishedApr 5
Latest updateMay 24

Description

The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

▶NVDthemeum/tutor_lms< 1.8.3

🔴Vulnerability Details

3
GHSA
GHSA-vfx3-5xwg-q5jm: The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1↗2022-05-24
▶
CVEList
Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_question_form↗2021-04-05
▶
VulnCheck
themeum tutor_lms Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')↗2021
▶
CVE-2021-24183 — SQL Injection in Themeum Tutor LMS | cvebase