This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: Time-based SQL Injection in LearnPress plugin. π₯ **Consequences**: Attackers can steal sensitive DB data, compromise site integrity, and potentially take over the server.β¦
π‘οΈ **Root Cause**: CWE-89 (SQL Injection). π **Flaw**: Insufficient escaping of the `order_by` parameter + lack of prepared statements. The code blindly trusts user input when building SQL queries.
Q3Who is affected? (Versions/Components)
π₯ **Affected**: WordPress Plugin **LearnPress**. π¦ **Versions**: 4.2.5.7 and earlier. π’ **Vendor**: ThimPress. If you run an LMS site with this plugin, you are at risk.
Q4What can hackers do? (Privileges/Data)
π **Hackers Can**: Extract `user_pass` hashes, dump entire database tables, and escalate privileges. π **Data at Risk**: User credentials, course data, and potentially admin secrets. Full database access is possible.
Q5Is exploitation threshold high? (Auth/Config)
π **Threshold**: LOW. π« **Auth Required**: None (Unauthenticated). π **Access**: Remote. Any visitor can trigger the exploit via the `/wp-json/lp/v1/courses/` endpoint. No login needed.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π£ **Public Exp?**: YES. π **PoC**: Available on GitHub (mimiloveexe/CVE-2023-6567-poc). π οΈ **Tools**: Works with `sqlmap` using the `-r` flag. Wild exploitation is highly likely given the ease of use.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Scan for `order_by` parameter in LearnPress API endpoints. π‘ **Detection**: Use Nuclei templates (projectdiscovery). π§ͺ **Test**: Send time-delay payloads via `order_by` to detect blind SQLi responses.
π§ **No Patch?**: Disable the LearnPress plugin temporarily. π **Mitigation**: Block `/wp-json/lp/v1/` endpoints via WAF if possible. π« **Best**: Remove the plugin if not actively used. Do not leave it exposed.
Q10Is it urgent? (Priority Suggestion)
π₯ **Urgency**: CRITICAL. π¨ **Priority**: Patch IMMEDIATELY. CVSS Score is High (3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Unauthenticated access makes this a top-tier threat. Act now!