CVE-2022-47130

Deeper analysis

CVE-2022-47130 is a Cross-Site Request Forgery vulnerability affecting Academy LMS versions prior to 5.10. The flaw resides in the coupon management functionality and permits an attacker to trigger creation of arbitrary discount coupons when an authenticated administrative user is induced to interact with a malicious page.

An attacker can exploit the issue by crafting a web page that submits a forged request to the LMS coupon endpoint. Because the CVSS vector specifies network attack vector, low complexity, no required attacker privileges, and required user interaction, the attacker needs only to convince an administrator to visit the attacker-controlled page; successful exploitation results in unauthorized creation of discount coupons that could be used for financial abuse within the platform.

The supplied references consist primarily of general CSRF background material and a single technical write-up; none detail vendor patch instructions or mitigation steps beyond the implicit upgrade path to version 5.10 indicated in the CVE description. The associated EPSS score rose from a low baseline to a peak of 0.0554 on 2025-12-11 before receding to the current value of 0.0312, indicating a modest but observable increase in exploitation interest after disclosure.