CVE-2024-7349
📋 TL;DR
This vulnerability allows authenticated attackers with administrator-level access to perform blind SQL injection attacks via the 'order' parameter in the LifterLMS WordPress plugin. Attackers can extract sensitive database information by injecting malicious SQL queries. Only WordPress sites using vulnerable versions of the LifterLMS plugin are affected.
💻 Affected Systems
- LifterLMS WordPress Plugin
📦 What is this software?
Lifterlms by Lifterlms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including extraction of user credentials, payment information, and sensitive course data, potentially leading to full site takeover.
Likely Case
Extraction of user data, administrative credentials, and sensitive plugin configuration information from the database.
If Mitigated
Limited impact due to proper access controls and monitoring preventing successful exploitation.
🎯 Exploit Status
Exploitation requires administrator credentials but SQL injection is straightforward once authenticated
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.7.6
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3139798/lifterlms/tags/7.7.6/includes/abstracts/abstract.llms.database.query.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find LifterLMS and click 'Update Now'
4. Verify version shows 7.7.6 or higher
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the LifterLMS plugin until patched
wp plugin deactivate lifterlms
Web Application Firewall Rule
allBlock SQL injection attempts targeting the 'order' parameter
🧯 If You Can't Patch
- Restrict administrator account access to trusted IP addresses only
- Implement database monitoring for unusual SQL queries and enable query logging
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → LifterLMS version numberCheck Version:
wp plugin list --name=lifterlms --field=versionVerify Fix Applied:
Verify LifterLMS version is 7.7.6 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by successful administrator login
- Unusual 'order' parameter values in web server logs
Network Indicators:
- SQL injection patterns in HTTP requests to WordPress admin endpoints
SIEM Query:
source="web_server" AND ("order%3D" OR "order=") AND ("SELECT" OR "UNION" OR "INSERT" OR "UPDATE" OR "DELETE")