| عنوان | LearnHouse learnhouse 98dfad76aad70711a8113f6c1fdabfccf10509ca Insecure Direct Object Reference (IDOR) |
|---|
| الوصف | Attack Vector: Remote
Complexity: Low
Authentication Required: None
Confidentiality Impact: High
Integrity Impact: None
Availability Impact: None
A vulnerability has been discovered in LearnHouse LMS affecting all versions up to commit 98dfad7. The vulnerability exists in the static file serving mechanism for the /content/orgs/*/courses/*/assignments/*/subs/* route, which serves student assignment submissions without implementing authentication or authorization checks. An unauthenticated attacker can access any uploaded assignment file by constructing the direct URL path, leading to unauthorized disclosure of sensitive academic materials. The vulnerability has been publicly disclosed. |
|---|
| المصدر | ⚠️ https://gist.github.com/KhanMarshaI/f71f86fbd5d8e8363f9113a8c054c28b |
|---|
| المستخدم | KhanMarshal (UID 89610) |
|---|
| ارسال | 13/10/2025 11:58 AM (12 أشهر منذ) |
|---|
| الاعتدال | 26/10/2025 05:01 PM (13 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 329942 [LearnHouse حتى 98dfad76aad70711a8113f6c1fdabfccf10509ca Student Assignment Submission sub_file تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|