Chamilo Learning Management System SQL Injection Risk

Summary

The Chamilo learning management system is vulnerable to SQL injection attacks, which could allow an attacker to manipulate database queries. This issue affects all versions prior to 1.11.30, but has been fixed in the latest version. Update to version 1.11.30 or later to protect your system.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
chamilo	chamilo_lms	<= 1.11.30	–

Original title

Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the GET value parameter with the following scri...

Original description

Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the GET value parameter with the following scripts: /plugin/vchamilo/views/syncparams.php and /plugin/vchamilo/ajax/service.php, which allows an attacker to perform an attack aimed at modifying the database query logic by injecting an arbitrary SQL statements. This issue has been patched in version 1.11.30.

nvd CVSS3.1 7.2

nvd CVSS4.0 7.0

Vulnerability type

CWE-89 SQL Injection

https://github.com/chamilo/chamilo-lms/commit/ef54cc0906a3caaa3e7ac9b640b044f03b... Patch
https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 Product Release Notes
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-96j3-x45m-9q3r Exploit Mitigation Vendor Advisory