CVE-2022-28986

HIGH

LMS Doctor Simple <2021072900 - IDOR

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-28986. PoCs published by FlaviuPopescu.

AI-analyzed exploit summary This PoC demonstrates an Insecure Direct Object Reference (IDOR) vulnerability in the Simple 2FA Plugin for Moodle, allowing attackers to update sensitive user account details (email, password, phone number) by tampering with a base64-encoded JSON payload in the 'u' parameter.

Description

LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references (IDOR) vulnerability, which allows remote attackers to update sensitive records such as email, password and phone number of other user accounts.

Exploits (1)

nomisec WORKING POC 2 stars
by FlaviuPopescu · poc
https://github.com/FlaviuPopescu/CVE-2022-28986

This PoC demonstrates an Insecure Direct Object Reference (IDOR) vulnerability in the Simple 2FA Plugin for Moodle, allowing attackers to update sensitive user account details (email, password, phone number) by tampering with a base64-encoded JSON payload in the 'u' parameter.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Simple 2 Factor Authentication Plugin For Moodle by LMS Doctor
Auth required
Prerequisites: Valid user account with access to the 2FA prompt · Ability to intercept and modify HTTP requests (e.g., Burp Suite)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Broken Link x_refsource_misc
http://simple.com
Not Applicable x_refsource_misc
http://lms.com
Exploit, Third Party Advisory x_refsource_misc
https://github.com/FlaviuPopescu/CVE-2022-28986

Scores

CVSS v3 7.5
EPSS 0.0281
EPSS Percentile 84.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-639
Status published
Products (1)
lmsdoctor/2_factor_authentication 2021072900
Published May 10, 2022
Tracked Since Feb 18, 2026