CVE-2021-24182: Improper Neutralization of Special Elements used in an SQL Command

The tutorquizbuildergetanswersbyquestion AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students...

CVE-2021-24181: Improper Neutralization of Special Elements used in an SQL Command

The tutormarkanswerascorrect AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students...

CVE-2021-24186: Improper Neutralization of Special Elements used in an SQL Command

The tutoransweringquizquestion/getanswerbyid function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students...

CVE-2021-24185: Improper Neutralization of Special Elements used in an SQL Command

The tutorplacerating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students...

PT-2021-15731

Name of the Vulnerable Software and Affected Versions: Tutor LMS – eLearning and online course solution WordPress plugin versions prior to 1.7.7 Description: The issue concerns a SQL injection vulnerability in the tutor place rating AJAX action of the plugin. This could potentially be exploited b...

PT-2021-15729

Name of the Vulnerable Software and Affected Versions: Tutor LMS – eLearning and online course solution WordPress plugin versions prior to 1.8.3 Description: The issue concerns a UNION based SQL injection vulnerability in the tutor quiz builder get question form AJAX action. This could potentiall...

PT-2021-15728

Name of the Vulnerable Software and Affected Versions: Tutor LMS – eLearning and online course solution WordPress plugin versions prior to 1.8.3 Description: The issue concerns a UNION based SQL injection vulnerability in the tutor quiz builder get answers by question AJAX action. This could...

CVE-2021-24184: Missing Authorization

Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions...

PT-2021-15730

Name of the Vulnerable Software and Affected Versions: Tutor LMS – eLearning and online course solution WordPress plugin versions prior to 1.7.7 Description: The issue concerns unprotected AJAX endpoints in the plugin, which allows students to modify course information and elevate their privilege...

Tutor LMS < 1.8.8 - Authenticated Local File Inclusion

The plugin is affected by a local file inclusion vulnerability through the maliciously constructed subpage parameter of the plugin's Tools, allowing high privilege users to include any local php file https://your.domain/wp-admin/admin.php?page=tutor-tools&subpage=..%2F..%2F..%2F..%2F..%2F..%2Find...

Security Bulletin: IBM Kenexa LMS On Premise -[All] jQuery (Publicly disclosed vulnerability) - 180875

Summary We have identified that the IBM Kenexa LMS On Premise is affected by one or more security vulnerabilities. These have been addressed in LMS 6.1.0 version. Vulnerability Details Third Party Entry: 180875 DESCRIPTION: jQuery cross-site scripting CVSS Base score: 6.1 CVSS Temporal Score: See...

Security Bulletin: IBM Kenexa LMS On Premise -[All] jQuery (Publicly disclosed vulnerability) - CVE-2020-7656

Summary We have identified that the IBM Kenexa LMS On Premise is affected by one or more security vulnerabilities. These have been addressed in LMS 6.1.0 version. Vulnerability Details CVEID: CVE-2020-7656 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation of...

Security Bulletin: IBM Kenexa LMS On Premise -[All] jQuery (Publicly disclosed vulnerability) - CVE-2020-11023, CVE-2020-11022

Summary We have identified that the IBM Kenexa LMS On Premise is affected by one or more security vulnerabilities. These have been addressed in LMS 6.1.0 version. Vulnerability Details CVEID: CVE-2020-11023 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation o...

Tutor LMS for WordPress Open to Info-Stealing

Security vulnerabilities in Tutor LMS, a WordPress plugin installed on more than 20,000 sites, open the door to information theft and privilege escalation, according to researchers. Tutor LMS is a learning-management system for educators that allows them to digitally reach their students. It...

Tutor LMS < 1.7.7 - SQL Injection via tutor_place_rating

The tutorplacerating AJAX action from the plugin was vulnerable to blind and time based SQL injections that could be exploited by students. python3 sqlmap.py -r /tutor2.txt --dbms=mysql --technique=B -p courseid --dump Where tutor2.txt is POST /wp-admin/admin-ajax.php HTTP/1.1 Host: URL...

Tutor LMS < 1.7.7 - SQL Injection via tutor_place_rating

The tutorplacerating AJAX action from the plugin was vulnerable to blind and time based SQL injections that could be exploited by students. PoC python3 sqlmap.py -r /tutor2.txt --dbms=mysql --technique=B -p courseid --dump Where tutor2.txt is POST /wp-admin/admin-ajax.php HTTP/1.1 Host: URL...

Tutor LMS < 1.7.7 - SQL Injection via tutor_mark_answer_as_correct

The tutormarkanswerascorrect AJAX action from the plugin was vulnerable to blind and time based SQL injections that could be exploited by students. python3 sqlmap.py -r /tutortime.txt --dbms=mysql --technique=T -p answerid --dump Where tutortime.txt is POST /wp-admin/admin-ajax.php HTTP/1.1 Host:...

Tutor LMS < 1.7.7 - SQL Injection via tutor_mark_answer_as_correct

The tutormarkanswerascorrect AJAX action from the plugin was vulnerable to blind and time based SQL injections that could be exploited by students. PoC python3 sqlmap.py -r /tutortime.txt --dbms=mysql --technique=T -p answerid --dump Where tutortime.txt is POST /wp-admin/admin-ajax.php HTTP/1.1...

Tutor LMS < 1.7.7 - Unprotected AJAX including Privilege Escalation

Several AJAX endpoints in the plugin were unprotected, allowing students to modify course information and elevate their privileges among many other actions. Only one PoC provided for privilege escalation. $wpuser, 'pwd' = $wppass, 'rememberme' = 'forever', 'wp-submit' = 'Log+In', ; $output =...

Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_answers_by_question

The tutorquizbuildergetanswersbyquestion AJAX action from the plugin was vulnerable to UNION based SQL injection that could be exploited by students. PoC python3 sqlmap.py -r /tutorunion.txt --dbms=mysql --technique=U -p questionid --dump Where tutorunion.txt is POST /wp-admin/admin-ajax.php...