CVE-2024-1751

published 2024-03-13

CVE-2024-1751: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all…

Priority P2 62 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all versions up to, and including, 2.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber/student access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
themeum	tutor_lms	< 2.6.2	2.6.2
themeum	tutor_lms_elearning_and_online_course_solution	<= 2.6.1	—

Detection & IOCs extracted from sources · hover to see the quote

other question_id (SQL Injection parameter)↗

sigma

condition: and
- 'status_code == 200'
- 'contains(content_type, "application/json")'
- 'contains_any(body, "\"success\":true", "tutor-instructor-list")'

• → Monitor for time-based SQL injection patterns (e.g., SLEEP/BENCHMARK payloads) in the `question_id` parameter of requests to the Tutor LMS plugin endpoints. ↗
• → Alert on authenticated requests (subscriber/student role or higher) that trigger anomalous database response delays, indicative of time-based blind SQL injection via the question_id parameter. ↗
• → Inspect HTTP responses for JSON body containing 'success':true or 'tutor-instructor-list' strings as indicators of successful exploitation probing against the Tutor LMS plugin.
• → The nuclei-style digest fingerprint can be used to identify the specific exploit template: 4a0a00473045022100da3f758a6c35b06eea145e4578f762fd9c7acf4f8f2650f7a471b17e7074eeaf02201c033a8119389d5d474941250dc56313fedec1a60d8ea063f8d69353992cdfcc:922c64590222798bb761d5b6d8e72950

• · Vulnerability affects all Tutor LMS plugin versions up to and including 2.6.1; ensure detection rules are scoped to installations running these versions. ↗
• · Exploitation requires at minimum a subscriber or student-level authenticated session; unauthenticated requests cannot trigger this vulnerability. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89