# CVE-2020-6010
LearnPress • <= 3.2.6.7 • SQL Injection
Reported on 16-Mar-2020 by [Sagi Tzadik](/researcher/Sagi Tzadik), [Omri Herscovici](/researcher/Omri Herscovici)
CPR-ID: 2150
Upload Date: 04-Aug-20
## Information
The method `_get_items` of the class `LP_Modal_Search_Items` (`class-lp-modal-
search-items.php`) is vulnerable to SQL Injection.
The method fails to sufficiently sanitize user-supplied data (GET/POST
parameter `current_items`) before using it in an SQL query.
The vulnerability can be triggered by browsing to the following URL as an
authenticated user:
/wp-admin/admin-ajax.php/learn-press/ajax/?lp-ajax=modal_search_items¤t_items[]=-1+UNION+SELECT+SLEEP(10)
Can also be triggered via
POST /wordpress5.3.2/wp-admin/admin-ajax.php
action=learnpress_modal_search_items¤t_items[]=-1+UNION+SELECT+SLEEP(10)
**References:**
<https://research.checkpoint.com/2020/e-learning-platforms-getting-schooled-
multiple-vulnerabilities-in-wordpress-most-popular-learning-management-system-
plugins>
京公网安备 11010502034610号
暂无评论