diff --git a/mod/scorm/loaddatamodel.php b/mod/scorm/loaddatamodel.php
index f9d6ba1bff6..5ccd30e9551 100644
--- a/mod/scorm/loaddatamodel.php
+++ b/mod/scorm/loaddatamodel.php
@@ -44,6 +44,13 @@ if (!empty($id)) {
     print_error('missingparameter');
 }
 
+// PARAM_RAW is used for $currentorg, validate it against records stored in the table.
+if (!empty($currentorg)) {
+    if (!$DB->record_exists('scorm_scoes', array('scorm' => $scorm->id, 'identifier' => $currentorg))) {
+        $currentorg = '';
+    }
+}
+
 $PAGE->set_url('/mod/scorm/loaddatamodel.php', array('scoid'=>$scoid, 'id'=>$cm->id));
 
 require_login($course, false, $cm);
diff --git a/mod/scorm/player.php b/mod/scorm/player.php
index cfc0dacb3fc..db197dbb053 100644
--- a/mod/scorm/player.php
+++ b/mod/scorm/player.php
@@ -51,6 +51,14 @@ if (!empty($id)) {
 } else {
     print_error('missingparameter');
 }
+
+// PARAM_RAW is used for $currentorg, validate it against records stored in the table.
+if (!empty($currentorg)) {
+    if (!$DB->record_exists('scorm_scoes', array('scorm' => $scorm->id, 'identifier' => $currentorg))) {
+        $currentorg = '';
+    }
+}
+
 // If new attempt is being triggered set normal mode and increment attempt number.
 $attempt = scorm_get_last_attempt($scorm->id, $USER->id);
 
diff --git a/mod/scorm/prereqs.php b/mod/scorm/prereqs.php
index a507ef910d1..d61cb42356e 100644
--- a/mod/scorm/prereqs.php
+++ b/mod/scorm/prereqs.php
@@ -50,6 +50,13 @@ if (!empty($id)) {
     print_error('missingparameter');
 }
 
+// PARAM_RAW is used for $currentorg, validate it against records stored in the table.
+if (!empty($currentorg)) {
+    if (!$DB->record_exists('scorm_scoes', array('scorm' => $scorm->id, 'identifier' => $currentorg))) {
+        $currentorg = '';
+    }
+}
+
 $PAGE->set_url('/mod/scorm/prereqs.php', array('scoid'=>$scoid, 'attempt'=>$attempt, 'id'=>$cm->id));
 
 require_login($course, false, $cm);