CVE-2021-24186 — SQL Injection in Tutor LMS

CWE-89 — SQL Injection6 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.6%
top 29.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Themeum Tutor LMS
Timeline
PublishedApr 5
Latest updateMay 24

Description

The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

▶NVDthemeum/tutor_lms< 1.8.3

🔴Vulnerability Details

3
GHSA
GHSA-5fhw-gmrx-mwwc: The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1↗2022-05-24
▶
CVEList
Tutor LMS < 1.8.3 - SQL Injection via tutor_answering_quiz_question/get_answer_by_id↗2021-04-05
▶
VulnCheck
themeum tutor_lms Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')↗2021
▶

💥Exploits & PoCs

2
Exploit-DB
WordPress Plugin wpDiscuz 7.0.4 - Remote Code Execution (Unauthenticated)↗2021-06-08
▶
Exploit-DB
Wordpress Plugin wpDiscuz 7.0.4 - Arbitrary File Upload (Unauthenticated)↗2021-06-07
▶
CVE-2021-24186 — SQL Injection in Themeum Tutor LMS | cvebase