Chamilo Learning Management System: Malicious Database Modification

Summary

An outdated version of the Chamilo learning management system can allow an attacker to manipulate database settings, potentially causing data loss or disruption. This is a serious issue because it could lead to unauthorized changes to the system. Update to version 1.11.30 or later to fix this issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
chamilo	chamilo_lms	<= 1.11.30	–

Original title

Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/editinstance.php via the POST main_database parameter. Th...

Original description

Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/editinstance.php via the POST main_database parameter. This issue has been patched in version 1.11.30.

nvd CVSS3.1 7.2

nvd CVSS4.0 7.1

Vulnerability type

CWE-78 OS Command Injection

https://github.com/chamilo/chamilo-lms/commit/afdbd4bb9a9ea17b7740559dd4e05aa13b... Patch
https://github.com/chamilo/chamilo-lms/commit/e343c764493b457c82d1e85b91a3655b09... Patch
https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 Product Release Notes
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-qfvp-xg47-m7m2 Exploit Mitigation Vendor Advisory