Executive brief
JoomShaper SP LMS, a learning management system extension for Joomla, contains a critical security flaw that allows attackers to take full control of the server. By sending a specially crafted web request containing malicious cookie data, an unauthenticated user can execute their own code. This could lead to a complete compromise of the website, theft of student or instructor data, and total service disruption.
Technical details
The SP LMS (com_splms) extension for Joomla fails to properly validate user-supplied data within cookies before passing it to a PHP deserialization function. This 'Deserialization of Untrusted Data' (CWE-502) vulnerability allows a remote, unauthenticated attacker to perform object injection. By crafting a malicious serialized payload in a cookie, an attacker can trigger arbitrary code execution in the context of the web server. The issue is resolved in version 4.1.4.
Affected products
- JoomShaper SP LMS extension for Joomla 1.0.0-4.1.3
Timeline
- 2026-06-20: disclosed
- 2026-06-20: advisory