Exploitation Summary
EIP tracks 1 public exploit for CVE-2022-28986. PoCs published by FlaviuPopescu.
AI-analyzed exploit summary This PoC demonstrates an Insecure Direct Object Reference (IDOR) vulnerability in the Simple 2FA Plugin for Moodle, allowing attackers to update sensitive user account details (email, password, phone number) by tampering with a base64-encoded JSON payload in the 'u' parameter.
Description
LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references (IDOR) vulnerability, which allows remote attackers to update sensitive records such as email, password and phone number of other user accounts.
Exploits (1)
This PoC demonstrates an Insecure Direct Object Reference (IDOR) vulnerability in the Simple 2FA Plugin for Moodle, allowing attackers to update sensitive user account details (email, password, phone number) by tampering with a base64-encoded JSON payload in the 'u' parameter.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N