Description:

CVE-2024-1512 is a union-based SQL injection vulnerability in the MasterStudy LMS WordPress Plugin. It allows unauthenticated attackers to append additional SQL queries to existing ones, potentially extracting sensitive information from the database.

Key Insights:

• High Severity: The CVSS score of 9.8 indicates a critical vulnerability requiring immediate attention.
• SVRS Score: The SVRS score of 30 suggests a moderate risk, indicating that the vulnerability is not as severe as others with higher scores.
• Exploit Status: Active exploits have been published, making it crucial for organizations to patch their systems promptly.

Mitigation Strategies:

• Update the MasterStudy LMS WordPress Plugin to version 3.2.6 or later.
• Implement input validation and sanitization to prevent malicious SQL queries.
• Use a web application firewall (WAF) to block malicious requests.
• Regularly monitor logs for suspicious activity and take appropriate action.

Additional Information:

• Threat Actors/APT Groups: No specific threat actors or APT groups have been identified as actively exploiting this vulnerability.
• CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning for this vulnerability.
• In the Wild: There is no evidence that this vulnerability is actively exploited in the wild.

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.