Lucene search

Emad-fazelWPEX-ID:1049E940-49B1-4236-BEA2-C636F35C5647

HistorySep 25, 2023 - 12:00 a.m.

Tutor LMS < 2.3.0 - Subscriber+ Stored Cross-Site Scripting

2023-09-2500:00:00

emad-fazel

tutor lms

version 2.3.0

subscriber+

stored xss

cross-site scripting

dashboard plugin

payload

first name

last name

update profile

exploit

6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

JSON

Description The plugin does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

1. Register a student account and go to the "Dashboard" plugin (https://example.com/dashboard/settings/)
2. Add the payload `<svg/onload=alert(origin)>` to either the "First Name" or "Last Name" fields.
3. Click on "Update Profile" and reload the page.
4. When you do that, you will see the XSS.