CVE-2021-24182
Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_answers_by_question
Severity Score
6.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
La acción AJAX tutor_quiz_builder_get_answers_by_question del plugin de WordPress Tutor LMS – eLearning and online course solution versiones anteriores a 1.8.3, era vulnerable a una inyección SQL basada en UNION que podía ser explotada por estudiantes
*Credits:
Chloe Chamberland
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-01-14 CVE Reserved
- 2021-03-15 CVE Published
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- 2024-08-08 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
References (2)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://wpscan.com/vulnerability/f74dfc52-46ba-41e3-994b-23115a22984f | 2024-08-03 | |
| https://www.wordfence.com/blog/2021/03/several-vulnerabilities-patched-in-tutor-lms-plugin | 2024-08-03 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|