Totara Learning LMS is vulnerable to HTML injection via its messaging client, which may lead to session hijacking and unauthorized command execution within a victim's browser session.

The vulnerability is an HTML injection flaw located in the in-app messaging client. It requires an authenticated user to trigger the malicious payload, which is then rendered in the browsers of other users within the application.

Successful exploitation of this vulnerability could result in session hijacking, where an attacker gains unauthorized access to a user's account and data. Given the CVSS score of 8.0, the impact on integrity and confidentiality is substantial, potentially leading to unauthorized actions performed under the guise of an authenticated user or the theft of sensitive information stored within the LMS.

Immediate Action: Audit the Totara Learning environment and restrict messaging capabilities if possible, while awaiting an official patch from the vendor.

Proactive Monitoring: Monitor application logs for unusual HTML tags or anomalous patterns within the messaging service that deviate from standard text enhancement usage.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to detect and block common injection payloads targeting the messaging endpoint.

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub.

Organizations utilizing Totara Learning should prioritize this vulnerability due to its high severity and potential for account compromise. Administrators must verify their current version and coordinate with the vendor for the release of a security update that addresses the messaging client sanitization logic.