Totara LMS HTLM Injection Vulnerability Allowing Session Hijacking

A HTLM injection vulnerability has been identified in Totara LMS versions through 19.1.5. This vulnerability allows an attacker to inject malicious HTLM code into a message, which can then be sent to all users within the application. The injected code could be executed in the context of the user's session, potentially leading to session hijacking and unauthorized command execution on the victim's browser.

Impact

Exploitation of this vulnerability could result in HTLM injection, allowing for the execution of malicious HTLM code in the context of the user's session. This could lead to session hijacking and unauthorized command execution on the victim's browser.

Remediation

Users are advised to update to Totara LMS versions after 19.1.5. Additionally, implementing input/output sanitization in the messages component can help mitigate this vulnerability.