View online: https://www.drupal.org/sa-contrib-2024-032

Project: Opigno [1] Date: 2024-August-21 Security risk: *Critical* 16∕25 AC:Complex/A:User/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: Arbitrary PHP code execution

Description:  The Opigno module is related to Opigno LMS distribution. Opigno Scorm submodule exposes an API for extracting and handling SCORM packages.

Uploaded files were not sufficiently validated to prevent arbitrary file uploads, which could lead to Remote Code Execution (RCE) and/or Cross Site Scripting (XSS).

This vulnerability is mitigated by the fact that it affected only specific activity types.

Solution:  Install the latest version:

* If you use the /opigno/ module, upgrade to opigno 7.x-1.23 [3]

Reported By:  * Yurii Boichenko [4] * Marcin Grabias [5] * catch [6] of the Drupal Security Team

Fixed By:  * Yurii Boichenko [7]

Coordinated By:  * Greg Knaddison [8] of the Drupal Security Team * Juraj Nemec [9] of the Drupal Security Team

[1] https://www.drupal.org/project/opigno [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/opigno/releases/7.x-1.23 [4] https://www.drupal.org/user/624860 [5] https://www.drupal.org/user/1599440 [6] https://www.drupal.org/user/35733 [7] https://www.drupal.org/user/624860 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/u/poker10