.. / CVE-2023-0236

Exploit for WordPress Plugin Tutor LMS < 2.0.10 - Cross-Site Scripting (CVE-2023-0236)

Description:

WordPress Tutor LMS plugin before 2.0.10 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the reset_key and user_id parameters before outputting then back in attributes. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site, which can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This vulnerability can be used against high-privilege users such as admin.

Affected Products:

WordPress Plugin Tutor LMS < 2.0.10

Proof of Concept

PoC exploit

https://wpscan.com/vulnerability/503835db-426d-4b49-85f7-c9a20d6ff5b8

Nuclei Template

View the template here CVE-2023-0236.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2023/CVE-2023-0236.yaml

References:

https://nvd.nist.gov/vuln/detail/CVE-2023-0236
https://wpscan.com/vulnerability/503835db-426d-4b49-85f7-c9a20d6ff5b8

.. / CVE-2023-0236 if(localStorage["style"]=="true"){ document.getElementById('pagestyle').setAttribute('href','/assets/styleDark.css'); document.querySelector('input[type="checkbox"]').checked = true }