Tutor LMS Plugin Vulnerable to SQL Injection
CVE-2024-4318
6.5MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 16 May 2024
What is CVE-2024-4318?
The Tutor LMS plugin for WordPress is susceptible to a time-based SQL Injection vulnerability through the 'question_id' parameter, impacting versions up to and including 2.7.0. This vulnerability stems from inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries. Authenticated attackers with Instructor-level permissions or higher can exploit this vulnerability by appending additional SQL queries to the original ones, thereby gaining unauthorized access to sensitive database information.
Affected Version(s)
Tutor LMS – eLearning and online course solution * <= 2.7.0