Security breach in LMS - Forum | JoomShaper
Solved Extensions

Security breach in LMS

Asked by Yann TASSY 2 years ago Last activity 2 years ago

I'm using LMS plug-in more and more.
I found a security issue.

Steps to reproduce:

  • Create an LMS purchases menu item
  • Create LMS Certificates for somes students
  • Log in with the account of one of the students
  • Access their certificate
  • In the URL, change the value of the certificate ID. (?view=certificate&id=xxxxx) and set another id
  • The student can access all the certificates of all the other students.

Thanks !
Yann

Accepted answer

Marked as the solution
Rashida Rahman Staff
2 years ago

Hi there!

Thanks for reporting this. We will check and forward it to the developer team for resolution.

Best Regards

5 more replies

Oldest first Newest first Most helpful
Yann TASSY Asked this
2 years ago

Thank you a lot !
Yann

Rashida Rahman Staff
2 years ago

Hi Yann,

We have released a security patch for SP LMS. You can find it here:

https://www.joomshaper.com/downloads/extension/sp-lms

Please try this new build and let us know if it resolves the issue for you.

Best Regards

Yann TASSY Asked this
2 years ago

I've just tested it and it works!

Thanks for being so quick!
Yann

Rashida Rahman Staff
2 years ago

Thanks for letting us know about your feedback:)

Have a nice day!

Yann TASSY Asked this
2 years ago

Done !

Rashida Rahman Staff
2 years ago

Thankful for this response:)

Log in to reply.