Open eClass 3.15 Remote Code Execution: Detection, Hardening, and Remediation Guide for Education Sector Defenders

---
title: Web Server Process Spawning Shell - Possible Open eClass RCE Exploitation
id: 3c8f2a71-9d4b-4e6a-b5c2-7f1a0e8d3b44
status: experimental
description: Detects the web server service account spawning shell, interpreter, or system utility processes - a hallmark of PHP webshell execution following LMS RCE exploitation such as the Open eClass 3.15 exploit.
references:
  - https://www.exploit-db.com/exploits/52698
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1505.003
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentUser:
      - 'www-data'
      - 'apache'
      - 'nginx'
      - 'wwwrun'
  selection_image:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/php'
      - '/nc'
      - '/ncat'
      - '/curl'
      - '/wget'
      - '/base64'
  condition: all of selection_*
falsepositives:
  - Legitimate plugin or cron-driven scripts executed under the web service account (rare on well-configured LMS hosts)
level: high
---
title: PHP Webshell Dropped in Open eClass Upload or Course Directory
id: 5e1d9b36-2c7a-4f48-a9d1-6b3e0c4a8f27
status: experimental
description: Detects creation of PHP files in web-accessible upload, course document, or temporary directories used by Open eClass - consistent with webshell deployment after exploitation of the Open eClass 3.15 RCE flaw.
references:
  - https://www.exploit-db.com/exploits/52698
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/courses/'
      - '/video/'
      - '/tmp/'
      - '/uploads/'
  selection_path_doc:
    TargetFilename|contains: '/document/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.php5'
      - '.php7'
      - '.pht'
  condition: selection_ext and 1 of selection_path*
falsepositives:
  - Legitimate Open eClass upgrades or module installations writing PHP files under the application tree (exclude upgrade maintenance windows)
level: critical
---
title: HTTP Request to PHP File in Open eClass Course Upload Directory
id: 8a4c1e92-6f3b-4d58-b7e4-2d9a5c0f6e13
status: experimental
description: Detects web access log entries requesting PHP files within Open eClass course storage or upload paths - directories that should serve only static content. Strong post-exploitation indicator for the Open eClass 3.15 code execution flaw.
references:
  - https://www.exploit-db.com/exploits/52698
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/courses/'
      - '/video/'
      - '/uploads/'
  selection_doc:
    cs-uri|contains: '/document/'
  selection_ext:
    cs-uri|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.pht'
  condition: selection_ext and 1 of selection_*
falsepositives:
  - Uncommon; some legacy LMS modules reference PHP under content paths - baseline your environment before enabling at critical level
level: high

// Hunt for webshell execution indicators on Linux LMS hosts via Syslog/process audit ingestion
// and requests to PHP files in Open eClass course upload paths via web/proxy logs.
union isfuzzy=true
(
    Syslog
    | where TimeGenerated > ago(7d)
    | where ProcessName has_any ("sh", "bash", "dash", "python", "python3", "perl", "nc", "ncat", "curl", "wget")
    | where SyslogMessage has_any ("www-data", "apache", "nginx")
    | project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
),
(
    CommonSecurityLog
    | where TimeGenerated > ago(7d)
    | where RequestURL has_any ("/courses/", "/uploads/", "/video/")
    | where RequestURL endswith_any (".php", ".phtml", ".phar", ".pht")
    | where RequestURL has "/document/" or RequestURL has_any ("/courses/", "/uploads/")
    | summarize Requests = count(), UniqueSources = dcount(SourceIP) by RequestURL, SourceIP, DestinationHostName
    | order by Requests desc
)

-- Hunt for PHP webshells planted in Open eClass upload/course directories
-- and processes spawned by the web service account.
SELECT * FROM split_rows(
  query={
    SELECT FullPath, Size, Mtime, Ctime,
           upload(accessor='file', file=FullPath) AS File
    FROM glob(globs=['/var/www/**/courses/**/*.php',
                     '/var/www/**/uploads/**/*.php',
                     '/srv/**/courses/**/*.php',
                     '/var/www/**/video/**/*.php'])
    WHERE NOT FullPath =~ 'config'
  },
  query_type='VQL')
UNION ALL
SELECT * FROM split_rows(
  query={
    SELECT Pid, Name, CommandLine, Username, CreateTime, Exe
    FROM pslist()
    WHERE Username =~ 'www-data|apache|nginx'
      AND Name =~ 'sh|bash|python|perl|nc|ncat|curl|wget'
  },
  query_type='VQL')

#!/bin/bash
# Open eClass 3.15 RCE - exposure check and interim hardening
# Run as root on the Open eClass host. Review output before taking action.

echo "=== [1] Identify installed Open eClass version ==="
grep -ri "eclass_version\|version" /var/www/*/config/config.php 2>/dev/null | head -20
find /var/www /srv/www -maxdepth 3 -name "config.php" -path "*eclass*" 2>/dev/null

echo "=== [2] Hunt for PHP files in upload/course document directories (webshell sweep) ==="
find /var/www /srv/www -type d \( -name "courses" -o -name "uploads" -o -name "video" \) 2>/dev/null | \
while read -r dir; do
  find "$dir" -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" -o -name "*.pht" \) -mmin -10080
 done

echo "=== [3] Check web logs for requests to PHP files in content paths ==="
grep -hE "(courses|uploads|video)/[^ ]*\.(php|phtml|phar|pht)" /var/log/apache2/access.log* /var/log/nginx/access.log* 2>/dev/null | tail -50

echo "=== [4] Check for shells/interpreters spawned by web service account (last 7 days) ==="
journalctl _COMM=auditd --since "7 days ago" 2>/dev/null | grep -E "(www-data|apache|nginx).*(sh|bash|python|perl|nc )" | tail -30
ausearch -k webshell_exec 2>/dev/null | tail -30

echo "=== [5] INTERIM HARDENING: block PHP execution in upload directories (Apache) ==="
cat > /etc/apache2/conf-available/block-php-in-uploads.conf <<'EOF'
<DirectoryMatch "^/var/www/.*/(courses|uploads|video)/">
    <FilesMatch "\.(php|phtml|phar|pht|php5|php7)$">
        Require all denied
    </FilesMatch>
</DirectoryMatch>
EOF
a2enconf block-php-in-uploads && systemctl reload apache2 && echo "[+] PHP execution blocked in upload paths."

echo "=== [6] Confirm web root file permissions are least-privilege ==="
find /var/www -type f -perm -o+w -path "*eclass*" 2>/dev/null | head -20

echo "=== DONE. Investigate any hits from steps 2-4 as a suspected compromise before patching. ==="