WitchSchool.com is an online school that provides education in Wicca, Paganism, and other metaphysical subjects. It offers courses on various aspects of Wiccan spirituality, magical practices, divination, and related topics. The website operates as a learning platform where students can enroll in classes, often with a structured curriculum, study materials, and mentor support. Some courses are free, while others require payment or membership to access.

Security Vulnerability Report
Vulnerability Title: WitchSchool Full Access
Date Discovered: Fall 2021
Tester: Rev. Jedite

Website Affected: http://witchschool.com
1. Vulnerability Details
    Type of Vulnerability: Broken Access Control
    Severity: Unknown
    Potential Impact: Unauthorized access to lesson pages that users are not registered for or have not paid to
    access.
    Affected Components: All lesson pages with the URL starting with https://witchschool.com/lesson_detail/.

2. Steps to Reproduce
    Log in to http://witchschool.com as a regular user
    Navigate to  https://witchschool.com/lesson_detail/###.
      Where ### is any number.
    Observe the page loading without restrictions.

    Example URLs:
      2nd Degree:  https://witchschool.com/lesson_detail/20
      3rd Degree:  https://witchschool.com/lesson_detail/216
      CWC103 Correllian Philosophy  https://witchschool.com/lesson_detail/66
      CWC104 Correllian Ministry:    https://witchschool.com/lesson_detail/67

3. Proof of Concept (PoC)
    Description: I have developed a basic Firefox plugin that automates the process of scraping bulk lesson pages
    from the site. The plugin sequentially accesses lesson URLs by manipulating the URL parameter, enabling users
    to access unauthorized lessons that they are not registered for.
    
    Functionality: The plugin takes a starting lesson URL and uses an incrementing counter to sequentially access
    lesson pages (e.g., https://witchschool.com/lesson_detail/001, https://witchschool.com/lesson_detail/002,
    etc.), allowing unauthorized access to lessons without proper access controls.
    Technical Details: The plugin automates the process, requiring only that the user is logged in to the website
    with a valid account.
    Download: https://hack-the-planet.cc/lib/exe/fetch.php/blog:firefox_plugin.zip

3.1 Installing Proof of Concept:
    Download from URL above.
    Unzip the files.
    Open Firefox.
    Type about:debugging in the address bar and hit Enter.
    Click "This Firefox" (or "This Nightly" if using Firefox Nightly).
    Click "Load Temporary Add-on" and select your manifest.json file.
    Run extension.
    Files will be out put to Downloads folder.

4. Responsible Disclosure Plan
    Contact Email: Please contact me at [email protected] to discuss this issue further.
    Public Disclosure: I plan to disclose the details of this vulnerability publicly after 30-days.