cve/2018/CVE-2018-25019.md

### [CVE-2018-25019](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25019)
![](https://img.shields.io/static/v1?label=Product&message=LearnDash%20LMS&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=2.5.4%3C%202.5.4%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-434%20Unrestricted%20Upload%20of%20File%20with%20Dangerous%20Type&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brighgreen)

### Description

The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndash_assignment_process_init() function, which could allow unauthenticated users to upload arbitrary files to the web server

### POC

#### Reference
- https://lists.openwall.net/full-disclosure/2018/01/10/17
- https://wpscan.com/vulnerability/9444f67b-8e3d-4cf0-b319-ed25e7db383a

#### Github
- https://github.com/ARPSyndicate/cvemon