CVE-2024-43282

Tutor LMS versions up to 2.7.2 contain a SQL injection vulnerability caused by improper sanitization of user input and inadequate query preparation. An attacker with administrator privileges or higher can inject malicious SQL commands to execute unauthorized queries and potentially extract sensitive data from the database. The vulnerability requires authentication at the administrator level to exploit. Version 2.7.3 and later address this security issue.

Based on public CVE data (MITRE/NVD).