Chamilo LMS vulnerabilities

In Chamilo LMS from 2.0.0 through at least 2.1.0, private Message.content is stored without server-side sanitization and rendered as HTML in MessageShow.vue and view_message.html.twig. An authenticated low-privilege user, including a student, can send crafted message content to an administrator, which executes in the recipient's browser when the inbox or message view is opened.

In Chamilo LMS prior to 2.0.1, an unauthenticated remote attacker can execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism.

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form. An unauthenticated attacker can execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover.

Chamilo LMS contains an OS Command Injection vulnerability in the file move function where user-controlled path values are passed directly into exec() shell commands without escapeshellarg(). Any authenticated user who is a teacher in a course can move a document and trigger arbitrary command execution as the web server user. The issue is fixed in versions 1.11.38 and 2.0.0-RC.3.

In Chamilo LMS prior to 2.0.1, career.lib.php and import_csv.php call PHP's native unserialize() on user_career.extra_data from the database without the allowed_classes: false option. An attacker able to write crafted serialized PHP objects can trigger POP gadget chains in Symfony, Doctrine, or Monolog components, leading to arbitrary OS command execution. The issue is fixed in version 2.0.1.

In Chamilo LMS from 2.0.0 until 2.0.1, GET /user/{username} is anonymously reachable and renders six user-editable profile fields inside {% autoescape false %} without server-side sanitization. A ROLE_STUDENT attacker can plant HTML in their profile that executes in the browser of any visitor, including administrators. The issue is fixed in version 2.0.1.

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the add, delete_gradebook_from_skill, save_profile, and delete_profile actions in public/main/inc/ajax/skill.ajax.php perform database mutations without Security::check_token() validation. An attacker can use cross-site request forgery to cause an authenticated administrator or DRH who visits a malicious page to create, modify, or delete skill records and profiles, or remove skill-gradebook associations. This issue is fixed in version 2.0.1.

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple eval() calls in the vendored PEAR HTML_QuickForm libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms use hardcoded element names; exploitation requires a developer-specific plugin or misconfiguration that lets user input reach those element names. Where that conditional path exists, the impact can be full server compromise. This issue is fixed in versions 1.11.40 and 2.0.1.

Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/. Unauthenticated or low-privileged users can call actions like get_users_by_group_course, user_by_all_roles, and export_all_certificates to harvest user names and other learners' certificate PDFs.

Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the open_answer_grade endpoint to expose other students' answers through feedback and consume AI quota.

Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the set_default_certificate endpoint with any course id and document id to tamper with certificate configuration for any course.

A cross-site scripting vulnerability was found in Chamilo LMS in the TicketManager::addProject function (file main/inc/lib/TicketManager.php) via manipulation of the Name argument. The attack may be performed remotely and the exploit has been publicly disclosed. A patch is available.

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint. The scripts are rendered in reporting views and execute in the browser sessions of teachers or administrators.

In Chamilo LMS prior to version 2.0.0-RC.3, an insecure direct object modification vulnerability in the PUT /api/users/{id} endpoint allows any authenticated user with ROLE_STUDENT to escalate their privileges to ROLE_ADMIN by modifying the roles field on their own user record.

In Chamilo LMS prior to 2.0.0-RC.3, an OS command injection exists in main/inc/ajax/gradebook.ajax.php in the export_all_certificates action. The course code from the session is concatenated into shell_exec() without sanitization, allowing arbitrary command execution via session manipulation.

An Insecure Direct Object Reference (IDOR) vulnerability in the /api/course_rel_users endpoint of Chamilo LMS prior to version 2.0.0-RC.3. An authenticated attacker can modify the user parameter in the request to enroll any arbitrary user into any course without proper authorization. The backend trusts user-supplied input and does not verify if the requester has permission to act on behalf of other users.

Chamilo LMS versions prior to 2.0.0-RC.3 have an IDOR vulnerability in the notebook module. An authenticated student can read private notes of any other user by manipulating the notebook_id parameter in the editnote action. The application fetches note content without ownership verification.

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the social post attachment upload functionality. An authenticated user can upload a malicious HTML file containing JavaScript via the /api/social_post_attachments endpoint. The file is served without sanitization, content type restrictions, or Content-Disposition header, causing JavaScript execution in the application context. This can lead to session hijacking, account takeover, privilege escalation, and other actions. This issue has been fixed in version 2.0.0-RC.3.

Chamilo LMS before version 2.0.0-RC.3 has a Server-Side Request Forgery (SSRF) vulnerability in the PENS plugin endpoint. The endpoint is accessible without authentication and accepts a package-url parameter that the server fetches without filtering private IP addresses.

Chamilo LMS version 2.0-RC.2 has an unauthenticated endpoint install.ajax.php that accepts arbitrary Symfony Mailer DSN, enabling SSRF into internal networks via SMTP. An unauthenticated attacker can also use the server as an open email relay.

In Chamilo LMS prior to 1.11.38 and 2.0.0-RC.3, multiple files use simplexml_load_string() without XXE protection. With the LIBXML_NOENT flag, arbitrary server files can be read.

Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, any authenticated user (including ROLE_STUDENT) can enumerate all platform users and access personal information (email, phone, roles) via GET /api/users, including administrator accounts. This vulnerability is fixed in 2.0.0-RC.3.

Chamilo LMS is a learning management system. Prior to 1.11.38, the get_user_info_from_username REST API endpoint returns personal information (email, first name, last name, user ID, active status) of any user to any authenticated user, including students. There is no authorization check. This vulnerability is fixed in 1.11.38.

Chamilo LMS prior to 1.11.38 allows unauthenticated access to Twig template files (.tpl) under /main/template/default/ via HTTP GET requests. These templates expose internal application logic, variable names, AJAX endpoint URLs, and admin panel structure.

Chamilo LMS prior to 2.0.0-RC.3 contains an IDOR vulnerability in the /social-network/personal-data/{userId} endpoint that lets any authenticated user access full personal data and API tokens of arbitrary users by modifying the userId parameter, resulting in mass disclosure of sensitive information and credentials.

Chamilo LMS prior to 2.0.0-RC.3 contains an Insecure Direct Object Reference (IDOR) vulnerability in the REST API stats endpoint. Any authenticated user (including low-privilege students with ROLE_USER) can read any other user's learning progress, certificates, and gradebook scores for any course, without enrollment or supervisory relationship.

Chamilo LMS prior to 1.11.38 and 2.0.0-RC.3 contains an Open Redirect vulnerability in the session course edit page. An attacker can redirect an authenticated administrator to an arbitrary external URL after saving coach assignment changes, and the redirect leaks the id_session parameter to the attacker's server.

Chamilo LMS prior to 2.0.0-RC.3 contains a Reflected Cross-Site Scripting (XSS) vulnerability in the exercise question list admin panel. The pagination code merges all $_GET parameters via array_merge() and outputs the result via http_build_query() directly into HTML href attributes without htmlspecialchars() encoding, allowing execution of arbitrary JavaScript in an authenticated teacher's browser.

Chamilo LMS from 1.11.0 to 2.0-beta.1 allows anyone to trigger a malicious redirect through the use of the redirect parameter to /login. This vulnerability is fixed in 2.0-beta.2.

SQL Injection vulnerability in Chamilo LMS versions 1.11 through 1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions functions.

A Cross-Site Scripting vulnerability was found in Chamilo LMS version 1.11.18. It allows a local attacker to execute arbitrary code via a crafted payload in the personal notes function.

A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18 in the 'My Progress' function. A local attacker can execute arbitrary JavaScript code via a crafted payload.

A Cross Site Scripting vulnerability was found in Chamilo LMS version 1.11.18. It allows a local authenticated attacker to execute arbitrary code via the homepage function.

A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can exploit the course category parameters to execute arbitrary JavaScript code in the victim's browser.

A Cross Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18. It allows a local attacker to execute arbitrary code via the resource sequencing parameters.

A Cross-Site Scripting vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can use the skype and linedin_url parameters to execute arbitrary JavaScript code in the victim's browser.

A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can execute arbitrary JavaScript code via the skills wheel parameter.

A Cross-Site Scripting vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can execute arbitrary JavaScript code via the forum title parameter.

A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18 in the system announcements parameter. It allows a local attacker to execute arbitrary JavaScript code in the victim's browser.

Chamilo LMS version 1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php. An attacker can exploit this by passing a hex2bin encoded message in the cookie.