CVE-2021-24183: SQL Injection
First published: Mon Apr 05 2021(Updated: )
The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Themeum Tutor Lms | <1.8.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-24183?
CVE-2021-24183 is a vulnerability in the Tutor LMS – eLearning and online course solution WordPress plugin before version 1.8.3 that allows UNION-based SQL injection.
How can CVE-2021-24183 be exploited?
CVE-2021-24183 can be exploited by students through the tutor_quiz_builder_get_question_form AJAX action, allowing them to perform SQL injection attacks.
What is the severity of CVE-2021-24183?
CVE-2021-24183 has a severity rating of 6.5, which is considered medium.
What software versions are affected by CVE-2021-24183?
The Tutor LMS plugin versions up to and excluding 1.8.3 are affected by CVE-2021-24183.
How can I fix CVE-2021-24183?
To fix CVE-2021-24183, update the Tutor LMS plugin to version 1.8.3 or later.
- collector/nvd-index
- vendor/themeum
- canonical/themeum tutor lms