Open eClass: Remote Code Execution

A proof-of-concept exploit (EDB-52698) has been released for Open eClass version 3.15. The vulnerability allows an attacker to achieve remote code execution on the underlying server. No CVE identifier is associated with this vulnerability in the current disclosure.

Impact

Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the web application user, potentially leading to full server compromise, data exfiltration, or lateral movement within the network.

Recommendation

• Inventory all instances of Open eClass within the environment to identify systems running version 3.15.
• Apply security patches or updates provided by the vendor if available; if no patch is available, isolate affected instances from the internet until remediated.
• Inspect web server access logs for anomalous POST requests or unusual parameters indicative of exploitation attempts.