From 1d7ff1fafcc516a9b1059248a1695b22dccc3a62 Mon Sep 17 00:00:00 2001
From: Ritik Chaddha <44563978+ritikchaddha@users.noreply.github.com>
Date: Tue, 20 Feb 2024 23:33:58 +0530
Subject: [PATCH] Create CVE-2024-1208.yaml

---
 http/cves/2024/CVE-2024-1208.yaml | 50 +++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 http/cves/2024/CVE-2024-1208.yaml

diff --git a/http/cves/2024/CVE-2024-1208.yaml b/http/cves/2024/CVE-2024-1208.yaml
new file mode 100644
index 0000000000..561c406dda
--- /dev/null
+++ b/http/cves/2024/CVE-2024-1208.yaml
@@ -0,0 +1,50 @@
+id: CVE-2024-1208
+
+info:
+  name: LearnDash LMS < 4.10.3 - Sensitive Information Exposure
+  author: ritikchaddha
+  severity: medium
+  description: |
+    The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it possible for unauthenticated attackers to obtain access to quiz questions.
+  remediation: Fixed in 4.10.3
+  reference:
+    - https://github.com/karlemilnikka/CVE-2024-1208-and-CVE-2024-1210
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-1208
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 5.3
+    cve-id: CVE-2024-1208
+    cpe: cpe:2.3:a:learndash:learndash:*:*:*:*:*:wordpress:*:*
+  metadata:
+    max-request: 1
+    verified: true
+    vendor: learndash
+    product: learndash
+    framework: wordpress
+    googledork-query: inurl:"/wp-content/plugins/sfwd-lms"
+    publicwww-query: "/wp-content/plugins/sfwd-lms"
+  tags: cve,cve2024,wp,wp-plugin,wordpress,exposure,learndash
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-json/wp/v2/sfwd-question"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"id":'
+          - '"question_type":'
+          - '"points_total":'
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - 'application/json'
+
+      - type: status
+        status:
+          - 200