{"id":55680,"date":"2025-06-28T04:19:43","date_gmt":"2025-06-28T04:19:43","guid":{"rendered":""},"modified":"2025-09-15T06:48:59","modified_gmt":"2025-09-15T12:48:59","slug":"cve-2025-46101-sql-injection-vulnerability-in-beakon-learning-management-system","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-46101-sql-injection-vulnerability-in-beakon-learning-management-system\/","title":{"rendered":"CVE-2025-46101: SQL Injection Vulnerability in Beakon Learning Management System<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The discovery of a significant SQL Injection vulnerability – identified as CVE-2025-46101, has raised concerns due to its potential for system compromise and data leakage. This vulnerability has been located in Beakon Software’s Learning Management System Sharable Content Object Reference Model (SCORM) versions prior to 5.4.3.
\nThis vulnerability is particularly critical<\/a> since it not only allows a remote attacker to exploit the system but also to gain access to sensitive information. Given the widespread use of Beakon’s Learning Management<\/a> System in academic and corporate sectors, this vulnerability could potentially impact a large number of users.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-46101
\nSeverity: Critical (CVSS 9.8)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Potential system<\/a> compromise and data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Beakon Learning Management System<\/a> (SCORM) | Prior to 5.4.3<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability originates from a flaw within the ‘ks’ parameter in the ‘json_scorm.php’ file. By sending a specially crafted SQL command to this parameter, an attacker can manipulate the SQL query to the database<\/a>. This manipulation can allow the attacker to bypass security measures, retrieve sensitive data, or even execute commands within the server<\/a>.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Below is a conceptual example of how this vulnerability might be exploited. Please note that this is a theoretical example and may not work exactly as is.<\/p>\n

GET \/json_scorm.php?ks=' OR '1'='1 HTTP\/1.1\nHost: target.example.com<\/code><\/pre>\n
In this request, the attacker manipulates the ‘ks’ parameter in the URL to potentially inject malicious SQL code<\/a>. The ‘OR ‘1’=’1′ is a classic SQL Injection<\/a> payload, which always evaluates to true, thereby allowing the attacker to bypass any conditional statements in the SQL query.<\/p>\n
Prevention and Mitigation<\/strong><\/p>\n
To mitigate this vulnerability<\/a>, it is highly recommended that users update their Beakon Learning Management System to version 5.4.3 or later, as this version has addressed and patched this specific vulnerability.
\nIn case immediate patching isn’t feasible, using Web Application Firewalls (WAF) or Intrusion Detection Systems (IDS) can provide temporary mitigation. These systems can help identify and block SQL Injection<\/a> attempts based on patterns and anomalies.
\nRemember, ensuring your systems are regularly updated and monitored is a key step in maintaining a secure environment.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The discovery of a significant SQL Injection vulnerability – identified as CVE-2025-46101, has raised concerns due to its potential for system compromise and data leakage. This vulnerability has been located in Beakon Software’s Learning Management System Sharable Content Object Reference Model (SCORM) versions prior to 5.4.3. This vulnerability is particularly critical since it not […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[74],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-55680","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-sql-injection"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t