Exploitation Summary
EIP tracks 1 public exploit for CVE-2022-28601. PoCs published by FlaviuPopescu.
AI-analyzed exploit summary The repository describes a 2FA bypass vulnerability in the Simple 2FA Plugin for Moodle, where an attacker can overwrite the phone number associated with an account to intercept 2FA codes. The PoC involves force-browsing to a specific URL to update the phone number without providing the 2FA code.
Description
A Two-Factor Authentication (2FA) bypass vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor allows remote attackers to overwrite the phone number used for confirmation via the profile.php file. Therefore, allowing them to bypass the phone verification mechanism.
Exploits (1)
The repository describes a 2FA bypass vulnerability in the Simple 2FA Plugin for Moodle, where an attacker can overwrite the phone number associated with an account to intercept 2FA codes. The PoC involves force-browsing to a specific URL to update the phone number without providing the 2FA code.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N