A critical vulnerability in DoceboLMS 1.2 allows unauthenticated remote attackers to achieve arbitrary code execution and database compromise.

The application is susceptible to SQL injection via the id, idC, and idU parameters in the lesson.php endpoint, alongside an arbitrary file upload vulnerability in the insert_image.php script. Both flaws are exploitable by unauthenticated attackers, enabling database query manipulation and the execution of malicious PHP scripts.

The ability for an unauthenticated user to upload arbitrary files and manipulate database queries poses a severe risk to organizational data integrity and system availability. Successful exploitation could lead to full system compromise, unauthorized access to sensitive learner records, and the potential for lateral movement within the network. With a CVSS score of 8.2, this vulnerability is categorized as High, reflecting the significant potential for total control over the affected application instance.

Immediate Action: Since no official patch is available for this legacy software, administrators must immediately restrict access to the vulnerable endpoints or disable the affected modules if they are not required for business operations.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting modules/htmlarea/popups/insert_image.php and abnormal GET requests containing SQL syntax in the lesson.php parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to block common SQL injection patterns and restrict file uploads to authorized, non-executable formats.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the Exploit-DB entry 45858.

The combination of SQL injection and arbitrary file upload vulnerabilities in this legacy software creates an unacceptable security risk. Given that a public exploit is available, the risk of automated or targeted exploitation is elevated. Organizations still utilizing DoceboLMS 1.2 should prioritize migrating to a supported learning management system immediately, as no official vendor patch is available to remediate these flaws.