Chamilo LMS: Malicious Code Can Hijack Admin Accounts

Summary

Chamilo's learning management system is vulnerable to a serious security issue that allows an attacker to take control of admin accounts and access sensitive information. This means an attacker can steal sensitive data, impersonate users, and make unauthorized changes. To stay safe, update to version 1.11.34 or later.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
chamilo	chamilo_lms	<= 1.11.34	–

Original title

Chamilo is a learning management system. Prior to version 1.11.34, there is a stored XSS vulnerability in Chamilo LMS (Verison 1.11.32) allows an attacker to inject arbitrary JavaScript into the pl...

Original description

Chamilo is a learning management system. Prior to version 1.11.34, there is a stored XSS vulnerability in Chamilo LMS (Verison 1.11.32) allows an attacker to inject arbitrary JavaScript into the platform’s social network and internal messaging features. When viewed by an authenticated user (including administrators), the payload executes in their browser within the LMS context. This enables full account takeover via session hijacking, unauthorized actions with the victim’s privileges, exfiltration of sensitive data, and potential self-propagation to other users. This issue has been patched in version 1.11.34.

nvd CVSS3.1 8.8

Vulnerability type

CWE-79 Cross-site Scripting (XSS)