CVE-2021-47907
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Rocket LMS 1.1 contains a persistent XSS vulnerability in the support ticket module allowing authenticated users to inject malicious script code via the title parameter. Scripts execute in browsers of other users viewing message history, enabling session hijacking and phishing attacks.
Risk Assessment
Breach of confidentiality and integrity of communication in the LMS system, potential credential theft and spread of malicious content.
Recommendation
Update Rocket LMS to the latest version. Implement input filtering and output encoding for all fields in the ticket module.
Original NVD description (English source)
Rocket LMS 1.1 contains a persistent cross-site scripting vulnerability in the support ticket module that allows authenticated users to inject malicious script code through the title parameter. Attackers can submit support tickets with embedded HTML/JavaScript payloads that execute in the browsers of other users viewing the message history, enabling session hijacking and phishing attacks.