CVE-2025-56747
📋 TL;DR
Creativeitem Academy LMS versions up to 5.13 contain a privilege escalation vulnerability where authenticated users can access instructor-only functions without proper role validation. This allows unauthorized course creation and management, affecting all installations using vulnerable versions.
💻 Affected Systems
- Creativeitem Academy LMS
📦 What is this software?
Academy Lms by Creativeitem
⚠️ Risk & Real-World Impact
Worst Case
Malicious users could create and manage courses, modify existing course content, potentially inject malicious code into course materials, and disrupt the entire learning platform.
Likely Case
Unauthorized users create spam courses, modify legitimate course content, or gain administrative-level access to course management functions they shouldn't have.
If Mitigated
With proper role-based access controls and input validation, impact is limited to failed privilege escalation attempts that are logged and blocked.
🎯 Exploit Status
Requires authenticated user access but no special privileges. Exploitation involves API endpoint manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 5.13
Vendor Advisory: https://suryadina.com/academy-lms-instructor-escalation-3n7b9f2w5k
Restart Required: No
Instructions:
1. Check current Academy LMS version. 2. If version is 5.13 or earlier, upgrade to the latest version. 3. Verify the Api_instructor controller has proper role validation.
🔧 Temporary Workarounds
Temporary Role Validation
allAdd manual role validation checks to the Api_instructor controller endpoints
Modify Api_instructor controller to include explicit role checks before processing requests
🧯 If You Can't Patch
- Implement network segmentation to isolate the Academy LMS instance
- Enable detailed logging and monitoring of all API requests to the Api_instructor controller
🔍 How to Verify
Check if Vulnerable:
Check if Academy LMS version is 5.13 or earlier in the admin panel or configuration files.Check Version:
Check admin panel or examine configuration files for version information.Verify Fix Applied:
Test authenticated user access to instructor-only API endpoints; they should be denied with proper error messages.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /api/instructor endpoints
- Course creation/modification by non-instructor users
- 403/401 errors from API endpoints
Network Indicators:
- Unusual API request patterns to instructor endpoints
- POST/PUT requests to course management APIs from non-instructor accounts
SIEM Query:
source="academy_lms" AND (uri_path="/api/instructor/*" AND user_role!="instructor")