CVE-2021-24242 Tutor LMS < 1.8.8 - Authenticated Local File Inclusion
High-privilege users can exploit a local file inclusion vulnerability in Tutor LMS to include arbitrary PHP files, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24242?
CVE-2021-24242 is a low-severity path traversal vulnerability in Themeum Tutor LMS – eLearning and online course solution, published on 22 Apr 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any local php file
Weakness: CWE-22
Which versions are affected by CVE-2021-24242?
It affects 1 product.
Products include Themeum Tutor Lms.
How do I fix CVE-2021-24242?
No fix has been published for CVE-2021-24242 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-24242 being exploited?
There is no known exploitation of CVE-2021-24242 in the wild and no public exploit code.
Other vulnerabilities in Themeum Tutor LMS – eLearning and online course solution
- CVE-2024-4223 Tutor LMS <= 2.7.0 - Missing Authorization
- CVE-2024-4318 Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection
- CVE-2024-4351 Tutor LMS Pro <= 2.7.0 - Missing Authorization to Privilege Escalation
- CVE-2024-4352 Tutor LMS Pro <= 2.7.0 - Missing Authorization to SQL Injection
- CVE-2024-1751 Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection
Sources
Also known as GHSA-p49c-32gv-6cc5.