Tutor LMS SQL Injection Vulnerability via Stored Quiz Answers

A SQL injection vulnerability has been identified in the Tutor LMS WordPress plugin, specifically in versions through 4.0.0. The issue arises from inadequate escaping of user-supplied data in the quiz answer array, allowing authenticated attackers with custom-level access or higher to inject malicious SQL. This injected SQL could be appended to existing queries, potentially leading to the extraction of sensitive database information. The vulnerability is exploited by sending a payload during the quiz attempt, which is then executed when a privileged user or Tutor REST API key holder accesses the quiz attempt details endpoint, creating a second-order injection scenario.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate database queries to extract sensitive information from the database.

Reproduction

To reproduce this vulnerability, an authenticated user with custom-level access or higher can take a quiz and submit answers that include malicious SQL injection payloads. After the quiz attempt is recorded, the injected SQL will be executed when the user requests the quiz attempt details through the Tutor REST API, specifically the 'quiz-attempt-details' endpoint.

Remediation

Users are advised to update the Tutor LMS plugin to version 4.0.1 or later, where this vulnerability has been patched.