Lmsdoctor - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/lmsdoctor/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 28 Aug 2026 08:24:38 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthentication Bypass in Simple 2 Factor Authentication Plugin for Moodlehttps://feed.craftedsignal.io/briefs/2026-08-cve-2022-28601/Fri, 28 Aug 2026 08:24:38 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-cve-2022-28601/CVE-2022-28601 allows an authenticated low-privileged user to bypass 2FA by overwriting a target account's associated phone number via the plugin's profile management endpoint.CVE-2022-28601 is a 2FA bypass vulnerability affecting the 'Simple 2 Factor Authentication' plugin for Moodle. The vulnerability allows a low-privileged user to exploit the plugin's profile management functionality to modify the phone number associated with an account. By overwriting the victim's legitimate phone number with an attacker-controlled number, the attacker forces the system to send the 2FA verification PIN to a device they control. This effectively grants the attacker control over the second factor of authentication, facilitating account takeover. The vulnerability exists within the plugin's handling of the /auth/simple2fa/profile.php endpoint. Although this is an older CVE, the recent publication of functional proof-of-concept (PoC) material on Sploitus necessitates immediate remediation for organizations still utilizing this specific Moodle plugin.

Attack Chain

  1. The attacker authenticates to the Moodle environment using a low-privileged account via POST /login/index.php.
  2. The system triggers a 2FA challenge, expecting a PIN input via POST /auth/simple2fa/confirm.php.
  3. Instead of completing the 2FA process, the attacker navigates to the plugin's profile management interface.
  4. The attacker sends a POST request to /auth/simple2fa/profile.php to overwrite the account's associated phone number.
  5. The server updates the record, binding the attacker's phone number to the target user account.
  6. The attacker re-initiates the login process or triggers a new 2FA request.
  7. The system sends the 2FA PIN to the phone number updated in step 4.
  8. The attacker receives the PIN on their device and submits it to the portal to bypass the authentication gate.

Impact

Successful exploitation allows unauthorized users to bypass secondary authentication, leading to full account takeover for any account targeted by an attacker. This impacts the confidentiality and integrity of educational data stored within the Moodle LMS. All versions of the Lmsdoctor 'Simple 2 Factor Authentication' plugin for Moodle are affected.

Recommendation

  • Audit Moodle server access logs for repeated POST requests to /auth/simple2fa/profile.php by low-privileged user accounts.
  • Disable or uninstall the 'Simple 2 Factor Authentication' plugin for Moodle if an official patch is not available from the vendor.
  • Implement compensating controls such as IP-based rate limiting on the /auth/simple2fa/ directory to detect and block forced browsing or automated exploitation attempts.
]]>lowadvisory