Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Chamilo LMS could let attackers delete files

CVE-2012-4030 · published 6 years ago
Summary

The Chamilo learning management system (versions before 1.8.8.6) does not correctly process data it receives through its index page. This weakness could let a remote attacker remove files from the server, potentially disrupting the system or exposing data. Upgrade to version 1.8.8.6 or later, or apply the vendor's recommended patch, to fix the issue.

What to do
  • Update chamilo chamilo_lms to version 1.8.8.6 or later.
Affected software
VendorProductAffected versions
chamilo chamilo_lms < 1.8.8.6
cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*
Original advisory text
Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote attackers to delete arbitrary files.
Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote attackers to delete arbitrary files.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published10 Jan 2020
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2012-4030 · NVD
Track software like this
Free during beta