Chamilo Learning Management System: Malicious Code Injection in Course Descriptions

Summary

If an attacker injects malicious code into a course description, they can take control of administrator accounts. This could happen if a low-privileged user, like a trainer, enters malicious code into a course description, which would then be executed when an administrator views the course information. Update to version 1.11.34 to fix this issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
chamilo	chamilo_lms	<= 1.11.34	–

Original title

Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting malicious JavaScript into the course description field, a...

Original description

Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting malicious JavaScript into the course description field, an attacker with a low-privileged account (e.g., trainer) can execute arbitrary JavaScript code in the context of any other user viewing the course information page, including administrators. This allows an attacker to exfiltrate sensitive session cookies or tokens, resulting in account takeover (ATO) of higher-privileged users. This issue has been patched in version 1.11.34.

nvd CVSS3.1 9.0

Vulnerability type

CWE-79 Cross-site Scripting (XSS)