CVE-2024-4434

CRITICALNuclei

LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-4434 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘term_id’ parameter in versions up to, and including, 4.2.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · May 10, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated May 10, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

Browse thimpress / LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

Default status: unaffected

CVE ListThrough 4.2.6.5affected

learnpress

Browse thimpress / learnpress

Default status: unknown

CVE List, VulnCheck4.2.6.5affected

Nuclei templates

1
ProjectDiscoveryCRITICALLearnPress WordPress LMS Plugin <= 4.2.6.5 - SQL InjectionCVSS 9.8

The LearnPress WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘term_id’ parameter in versions up to, and including, 4.2.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Impact

Unauthenticated attackers can execute time-based SQL injection to extract sensitive database information.

Remediation

Update LearnPress to version 4.2.6.6 or later.

Authorss4e-io
Template tagscvecve2024wpwp-pluginwordpresssqlilearnpressvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:thimpress:learnpress:*:*:*:*:wordpress:*:*:*
https://inky-knuckle-2c2.notion.site/Unauthenticated-SQLI-in-Learnpress-plugin-Version-4-2-6-5-a86fe63bcc7b4c9988802688211817fd https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/learnpress/learnpress-wordpress-lms-plugin-4265-unauthenticated-time-based-sql-injection https://nvd.nist.gov/vuln/detail/CVE-2024-4434

Source: ProjectDiscovery

References

5