CVE-2024-50672
A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administrator account passw…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Adapt Authoring Tool 0.11.3 - Remote Command Execution (RCE)2025-04-15 · webapps · multiple
Impact
A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administrator account passwords via the "Reset password" feature. The vulnerability occurs due to insufficient validation of user input, which is used as a query in Mongoose's find() function. This makes it possible for attackers to perform a full takeover of the administrator account. Attackers can then use the newly gained administrative privileges to upload a custom plugin to perform remote code execution (RCE) on the server hosting the web application.
Affected products
| Product | Affected versions |
|---|---|
| Adapt Learning Adapt Authoring Tool | through 0.11.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.