MasterStudy LMS vulnerabilities

A Cross Site Scripting (XSS) vulnerability in MasterStudy LMS plugin version 3.7.27 and earlier allows an attacker with subscriber role to inject malicious script. This can lead to session theft or redirection to a malicious site.

The MasterStudy LMS has a Blind SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects versions from n/a through 3.7.29.

Stored XSS vulnerability in MasterStudy LMS (up to 3.7.52) due to improper input neutralization.

The MasterStudy LMS WordPress Plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to.

The MasterStudy LMS WordPress plugin before version 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal (subscriber) role to read other students' quiz grades, pass/fail status and attempt timestamps by referencing an attempt identifier belonging to another user.

The MasterStudy LMS WordPress plugin before version 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content.

The MasterStudy LMS WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the Instructor role to disclose the names and email addresses of students enrolled in other instructors' courses.

The MasterStudy LMS WordPress Plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user.

The MasterStudy LMS WordPress Plugin before version 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other instructors.

The MasterStudy LMS WordPress Plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished (draft, pending and private) courses.

The MasterStudy LMS WordPress Plugin before version 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations.

The MasterStudy LMS WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs.

The MasterStudy LMS WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order IDs.

The MasterStudy LMS WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by paying only a token amount.

Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.

The MasterStudy LMS plugin version 3.7.41 and earlier has a broken access control vulnerability exploitable by Subscriber users. This means a subscriber can gain unauthorized access to functions they should not have permissions for.

Privilege Escalation vulnerability in MasterStudy LMS versions up to 3.7.41. The attack requires subscriber-level privileges.

The MasterStudy LMS plugin for WordPress (versions up to and including 3.7.39) has an insufficient verification of data authenticity vulnerability. It allows manipulating user state.

The MasterStudy LMS plugin for WordPress is vulnerable to Insecure Direct Object Reference in the stm_lms_delete_cover() function. Lack of ownership validation on the file_id parameter before calling wp_delete_attachment() allows authenticated users (Instructor and above) to delete arbitrary attachments of other users by enumerating IDs. Affects versions up to 3.7.14.

There is a SQL Injection vulnerability in the subscriber module in MasterStudy LMS versions up to 3.7.25.

The MasterStudy LMS plugin up to version 3.6.20 exposes sensitive system information to unauthorized control spheres. This vulnerability allows retrieval of embedded sensitive data.

The MasterStudy LMS WordPress plugin contains a Race Condition vulnerability caused by concurrent execution using a shared resource with improper synchronization. The issue affects versions up to and including 3.6.20.

The MasterStudy LMS plugin up to version 3.6.20 contains a Missing Authorization vulnerability. This allows exploiting incorrectly configured access control security levels.