CVE-2023-4974

Deeper analysis

CVE-2023-4974 is a SQL injection vulnerability rated critical in Academy LMS version 6.2. It resides in the GET parameter handler of the /academy/tutor/filter endpoint, where unsanitized manipulation of the price_min and price_max arguments allows arbitrary SQL commands to be injected into backend queries.

An attacker with low-privileged but authenticated access can launch the attack remotely over the network. Successful exploitation yields limited read, write, and impact on availability within the affected database context, consistent with the CVSS 6.3 vector that requires no user interaction and assumes a single security scope.

Public references consist of a Packet Storm proof-of-concept and multiple Vuldb entries; the vendor was notified prior to disclosure but issued no response or patch. The associated EPSS score reached a peak of 0.4795 after publication, indicating measurable post-disclosure exploitation interest that warrants monitoring.