Unauthenticated SQL Injection in MasterStudy LMS Plugin

CVE-2024-1512 is a critical security vulnerability discovered in the MasterStudy LMS WordPress plugin, affecting versions 3.2.5 and below. The flaw exists within the REST API endpoint '/lms/stm-lms/order/items', where the 'user' parameter is improperly sanitized before being included in database queries. This vulnerability allows an unauthenticated remote attacker to perform a union-based SQL injection. By injecting malicious SQL syntax through the 'user' parameter, an attacker can manipulate the application's database queries. This enables unauthorized actions including, but not limited to, full database content extraction, data deletion, or arbitrary manipulation of records. Given the lack of required authentication, the threat level is elevated for any WordPress site utilizing the affected plugin version.

Impact

Successful exploitation of CVE-2024-1512 grants an attacker the ability to bypass application security controls to interact directly with the backend database. This can lead to the total loss of confidentiality and integrity for site data, including user records, LMS course content, and administrative credentials. Organizations hosting sensitive educational or user data are at highest risk.

Recommendation

• Upgrade the MasterStudy LMS WordPress plugin to a version patched against CVE-2024-1512 immediately.
• Implement the provided web server detection rules to monitor for suspicious requests targeting the identified REST API endpoint.
• Review database access logs for anomalies originating from the '/lms/stm-lms/order/items' endpoint, specifically looking for common SQL injection patterns such as 'UNION SELECT' or time-based delay commands.