Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 26/01/2023 Updated: 07/11/2023

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 0

SQL Injection vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.

Vulnerable Product	Search on Vulmon	Subscribe to Product
thimpress learnpress

LearnPress Plugin < 4.2.0 - Unauthenticated SQLi

CVE-2022-45808 LearnPress Plugin < 420 - Unauthenticated time-based blind SQLi Description The plugin does not properly sanitise and escape the order by parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users POC $ python sqlmappy -u 'wordpresslan:80/wp-json/lp/v1/courses/archive-course' --data=&#

CWE-89 https://patchstack.com/articles/multiple-critical-vulnerabilities-fixed-in-learnpress-plugin-version/https://patchstack.com/database/vulnerability/learnpress/wordpress-learnpress-wordpress-lms-plugin-plugin-4-1-7-3-2-sql-injection?_s_id=cve https://nvd.nist.gov https://github.com/RandomRobbieBF/CVE-2022-45808

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2022-45808

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect