CVE-2021-24185 — SQL Injection in Tutor LMS

CWE-89 — SQL Injection3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.4%
top 36.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Themeum Tutor LMS
Timeline
PublishedApr 5
Latest updateMay 24

Description

The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

▶NVDthemeum/tutor_lms< 1.7.7

🔴Vulnerability Details

2
GHSA
GHSA-g8wh-vch5-x6pw: The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1↗2022-05-24
▶
CVEList
Tutor LMS < 1.7.7 - SQL Injection via tutor_place_rating↗2021-04-05
▶
CVE-2021-24185 — SQL Injection in Themeum Tutor LMS | cvebase