CVE-2021-24186
published 2021-04-05CVE-2021-24186: The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was…
PriorityP276medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
ITWVulnCheck KEV
Exploited in the wild
EPSS
1.25%
65.8th percentile
The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| themeum | tutor_lms | < 1.8.3 | 1.8.3 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vulncheck6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5fhw-gmrx-mwwc: The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1
ghsa_unreviewed·2022-05-24
CVE-2021-24186 [MEDIUM] CWE-89 GHSA-5fhw-gmrx-mwwc: The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1
The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
VulnCheck
themeum tutor_lms Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
vulncheck·2021·CVSS 6.5
CVE-2021-24186 [MEDIUM] themeum tutor_lms Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
themeum tutor_lms Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Affected: themeum tutor_lms
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/tutor/tutor-lms-182-sql-injection-via-tutor-answering-quiz-questionget-answer-by-id
No detection rules found.
Exploit-DB
WordPress Plugin wpDiscuz 7.0.4 - Remote Code Execution (Unauthenticated)
exploitdb·2021-06-08·CVSS 10.0
CVE-2020-24186 [CRITICAL] WordPress Plugin wpDiscuz 7.0.4 - Remote Code Execution (Unauthenticated)
WordPress Plugin wpDiscuz 7.0.4 - Remote Code Execution (Unauthenticated)
---
# Exploit Title: WordPress Plugin wpDiscuz 7.0.4 - Remote Code Execution (Unauthenticated)
# Date: 2021/06/08
# Exploit Author: Fellipe Oliveira
# Vendor Homepage: https://gvectors.com/
# Software Link: https://downloads.wordpress.org/plugin/wpdiscuz.7.0.4.zip
# Version: wpDiscuz 7.0.4
# Tested on: Debian9, Windows 7, Windows 10 (Wordpress 5.7.2)
# CVE : CVE-2020-24186
# Thanks for the great contribution to the code: Z3roC00l (https://twitter.com/zeroc00I)
#!/bin/python3
import requests
import optparse
import re
import random
import time
import string
import json
parser = optparse.OptionParser()
parser.add_option('-u', '--url', action="store", dest="url", help="Base target host: http://192.168.1.81/blog")
pa
Exploit-DB
Wordpress Plugin wpDiscuz 7.0.4 - Arbitrary File Upload (Unauthenticated)
exploitdb·2021-06-07·CVSS 10.0
CVE-2020-24186 [CRITICAL] Wordpress Plugin wpDiscuz 7.0.4 - Arbitrary File Upload (Unauthenticated)
Wordpress Plugin wpDiscuz 7.0.4 - Arbitrary File Upload (Unauthenticated)
---
# Exploit Title: Wordpress Plugin wpDiscuz 7.0.4 - Arbitrary File Upload (Unauthenticated)
# Google Dork: inurl:/wp-content/plugins/wpdiscuz/
# Date: 2021-06-06
# Original Author: Chloe Chamberland
# Exploit Author: Juampa Rodríguez aka UnD3sc0n0c1d0
# Vendor Homepage: https://gvectors.com/
# Software Link: https://downloads.wordpress.org/plugin/wpdiscuz.7.0.4.zip
# Version: 7.0.4
# Tested on: Ubuntu / WordPress 5.6.2
# CVE : CVE-2020-24186
#!/bin/bash
if [ -z $1 ]
then
echo -e "\n[i] Usage: exploit.sh [IP] [/index.php/2021/06/06/post]\n"
exit 0
elif [ -z $2 ]
then
echo -e "\n[i] Usage: exploit.sh [IP] [/index.php/2021/06/06/post]\n"
exit 0
else
post=$(curl -sI http://$1$2/ | head -n1)
if [[ "$post" == *"20
No writeups or analysis indexed.
https://wpscan.com/vulnerability/5f5c0c6c-6f76-4366-b590-0aab557f8c60https://www.wordfence.com/blog/2021/03/several-vulnerabilities-patched-in-tutor-lms-plugin/https://wpscan.com/vulnerability/5f5c0c6c-6f76-4366-b590-0aab557f8c60https://www.wordfence.com/blog/2021/03/several-vulnerabilities-patched-in-tutor-lms-plugin/
2021-04-05
Published
Exploited in the wild