cbcvebase.
CVE-2023-2636
published 2023-07-17

CVE-2023-2636: The AN_GradeBook WordPress plugin through 5.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL…

PriorityP263high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
3.25%
86.8th percentile
The AN_GradeBook WordPress plugin through 5.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber

Affected

1 ranges
VendorProductVersion rangeFixed in
an_gradebook_projectan_gradebook<= 5.0.1—

Detection & IOCsextracted from sources · hover to see the quote

commandsqlmap -u "http://<target>:<port>/wp-admin/admin-ajax.php?action=course&id=3" --level 2 --risk 2 --cookie="<session_cookie>" -p id -v 0 --answers="follow=Y" --batch↗
  • →Monitor for SQLi exploitation attempts against the AN_GradeBook plugin via the `action=course` parameter on admin-ajax.php. The vulnerable parameter is `id`, injectable by any subscriber-level authenticated user. ↗
  • →The exploit authenticates first via /wp-login.php and then reuses the session cookie for the SQLi request. Correlate a login event from a low-privilege (subscriber) account immediately followed by admin-ajax.php requests with `action=course` as a suspicious sequence. ↗
  • →The exploit uses sqlmap with `--level 2 --risk 2` and `-p id`, meaning detection rules should look for sqlmap-characteristic payloads in the `id` GET parameter on admin-ajax.php requests. ↗
  • ·The exploit was tested on WordPress 6.2.2 with AN_GradeBook <= 5.0.1. Environments running patched or updated versions of the plugin are not affected. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.