CVE-2019-15896 PoC — WordPress LifterLMS插件安全漏洞

Source

https://github.com/RandomRobbieBF/CVE-2019-15896

Associated Vulnerability

Title: WordPress LifterLMS插件安全漏洞 (CVE-2019-15896)
Description:An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.llms.admin.import.php script is prone to an unauthenticated options import vulnerability that could lead to privilege escalation (administrator account creation), website redirection, and stored XSS.

Description

LifterLMS <= 3.34.5 - Unauthenticated Options Import

Readme

# CVE-2019-15896
LifterLMS &lt;= 3.34.5 - Unauthenticated Options Import

# Description

Unauthenticated Options Import, which could lead to 

- Website Redirection

- Administrator Account Creation

- Content Injection

- Stored XSS

The issues have been reported as fixed in 3.35.0. However v3.35.1 added additional input sanitisation and filtering.


How to use
---
$ python3 CVE-2019-15896.py --url http://wordpress.lan --username radmin --email admin@admin.lan
LifterLMS <= 3.34.5 - Unauthenticated Options Import
Exploit By Ramdom Robbie
Once ran check your email for the forgotten password link.
Password reset email sent to admin@admin.lan
```

Info
---

```
Requires access to login.php and working email address and the site needs to be able to send emails
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →