CVE-2024-1512

CRITICALNuclei

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-1512 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 27, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

MasterStudy LMS WordPress Plugin – for Online Courses and Education

Browse stylemix / MasterStudy LMS WordPress Plugin – for Online Courses and Education

Default status: unaffected

CVE ListThrough 3.2.5affected

masterstudy_lms

Browse stylemixthemes / masterstudy_lms

Default status: unknown

CVE ListThrough 3.2.5affected

Proofs of concept

1

Repository PoCs

GitHubrat-c/CVE-2024-1512Repository PoCby rat-c2Not analyzed2 files

3.3 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryCRITICALMasterStudy LMS WordPress Plugin <= 3.2.5 - SQL InjectionCVSS 9.8

The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Impact

Unauthenticated attackers can extract sensitive information from the database including usernames, passwords, and other confidential data via time-based SQL injection.

Remediation

Update MasterStudy LMS plugin to version 3.2.6 or later.

Authorss4e-io
Template tagstime-based-sqlicvecve2024sqliwp-pluginwordpressvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
FOFA: body="wp-content/plugins/masterstudy-lms-learning-management-system/"
https://nvd.nist.gov/vuln/detail/CVE-2024-1512 https://github.com/rat-c/CVE-2024-1512 https://blog.csdn.net/m0_60571842/article/details/139901296 https://www.wordfence.com/threat-intel/vulnerabilities/id/d6b6d824-51d3-4da9-a39a-b957368df4dc?source=cve

Source: ProjectDiscovery

References

3