SB2019090903 - Multiple vulnerabilities in LifterLMS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019090903

SB2019090903 - Multiple vulnerabilities in LifterLMS

Published: September 9, 2019

Security Bulletin ID SB2019090903
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 67% Medium 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Open redirect (CVE-ID: N/A)

The vulnerability allows a remote attacker to redirect victims to arbitrary URL.

The vulnerability exists due to improper sanitization of user-supplied data. A remote attacker can create a link that leads to a trusted website via the “Location:” header, however, when clicked, redirects the victim to arbitrary domain.

Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.

Note: This vulnerability exists due to the CVE-2019-15896 issue described above.


2) Improper access control (CVE-ID: N/A)

The vulnerability allows a remote attacker to create an administrator account.

The vulnerability exists in the "get_author_id" function in the “includes/class.llms.generator.php” script due to the plugin will automatically create the corresponding administrator account if it cannot retrieve the user ID and email address of the author of the courses in the imported payload. A random administrator password is created by using the "wp_generate_password" function. A remote attacker can click on the login page “Lost your password” link and change the password.  

Note: This vulnerability exists due to the CVE-2019-15896 issue described above.





3) Improper Privilege Management (CVE-ID: CVE-2019-15896)

The vulnerability allows a remote attacker to unauthenticated options import to the target system.

The vulnerability exists in the main “lifterlms.php” script due to the plugin loads several scripts when the back-end is accessed, either by an authenticated or unauthenticated user (it simply relies on the "is_admin" function). A remote attacker can import a malicious JSON encoded payload. 

Note: An attacker can leverage this vulnerability to perform several critical attacks.

Remediation

Install update from vendor's website.

References