Executive brief
Rocket LMS, an online learning management platform, contains a security flaw in its support ticket system. An authenticated user, such as a student or instructor, can submit a support ticket containing malicious code that will automatically run in the browser of any staff member or administrator who views the ticket. This could allow an attacker to steal login sessions, redirect users to fraudulent websites, or perform unauthorized actions on behalf of administrators.
Technical details
A persistent cross-site scripting (XSS) vulnerability exists in Rocket LMS version 1.1 within the support ticket module. The vulnerability is caused by improper neutralization of user-supplied input in the 'title' parameter when creating a new support ticket via a POST request to /panel/support/store. Because the application fails to sanitize this input before storing it and subsequently rendering it in the 'Messages History' view, an authenticated attacker (student, instructor, or organization account) can execute arbitrary JavaScript in the context of other users, including administrators. This can lead to session hijacking via cookie theft or unauthorized redirection. While the vendor was notified in late 2021, the advisory does not explicitly confirm the version containing the fix, though the vulnerability is confirmed in version 1.1.
Affected products
- Rocketsoft Rocket LMS 1.1
Timeline
- 2021-09-03: disclosed: Researcher notification and coordination began
- 2021-09-04: other: Vendor notification
- 2021-12-29: advisory: Public disclosure by Vulnerability Laboratory
- 2026-05-10: other: NVD publication date