| 제목 | Selleo Labs Sp. z o.o. Mentingo learn-v2025.08.27 Cross Site Scripting |
|---|
| 설명 | Attack Vector: Web Application
Impact: Privilege Escalation
Brief Description: Stored XSS in course description field leading to admin privilege escalation
The LMS platform allows content creators or administrators to create new courses. The course description field does not sanitize or escape HTML input, which permits injection of malicious JavaScript.
The injected JavaScript executes immediately even as one is typing, after saving it, every time any user (student, content creator, or admin) visits the global courses catalogue view. The payload is triggered globally without requiring the victim to open the specific malicious course.
Depending on the payload and victim's role:
1. Student victim → attacker can silently enroll them in an attacker-controlled course via a forged `POST /api/course/enroll-course` request.
2. Admin victim → attacker can forge a `POST /api/user` request to provision a new administrative account, under the attacker’s control. The attacker then receives an activation email and sets a password, gaining persistent full administrative access to the platform. |
|---|
| 원천 | ⚠️ https://gist.github.com/KhanMarshaI/584ae9d7ba8578ac040a0f89597fc3c1 |
|---|
| 사용자 | KhanMarshal (UID 89610) |
|---|
| 제출 | 2025. 08. 29. AM 12:09 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 09. 13. AM 11:40 (15 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 323823 [Selleo Mentingo 2025.08.27 Create New Course Basic Settings enroll-course description 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|