Chamilo LMS

Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature. It extracts a ZIP archive before checking its content, and once it has been extracted, does not check files in a recursive way. This means that by putting a .php file in a folder and then this folder in a ZIP archive, the server will accept this file without any checks. Because one can access this file from the website, it is remote code execution. This is related to a scorm imsmanifest.xml file, the import_package function, and extraction in $courseSysDir.$newDir.

Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can result in Unauthenticated remote code execution. This attack appear to be exploitable via a simple GET request to the api endpoint. This vulnerability appears to have been fixed in After commit 0de84700648f098c1fbf6b807dee28ec640efe62.

Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php.

An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG file.

Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blog_id parameter at /blog/blog.php.

Chamilo: Evaluation of untrusted user input leads to Remote Code Execution

Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms

Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php

Chamilo: Error-based SQL Injection via GET openid.assoc_handle with the /index.php script

Chamilo: Time-based SQL Injection in /main/webservices/registration.soap.php

Chamilo LMS affected by unauthenticated RCE in main/install folder

Chamilo: PHAR deserialization bypass

OS Command Injection in Chamilo LMS 1.11.36

Chamilo: Blind Server-Side Request Forgery (Unauth Blind SSRF)

Chamilo LMS has Stored Cross Site Scripting on Social Networks Uploaded Files

Chamilo: Stored Cross Site Scripting in Skills Argumentation

Chamilo: Account Takeover via Stored XSS in Course Learning Paths

Chamilo: Account Takeover via Stored XSS in Course Description

Chamilo LMS Learning Path PPT2LP Command Injection Vulnerability

Chamilo LMS Learning Path PPT2LP Command Injection Vulnerability

Chamilo LMS has OS Command Injection via export_all_certificates action

A remote code execution (RCE) vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x allows authenticated attackers to execute arbitrary code via a crafted .htaccess file.

Chamilo LMS File Upload Functionality Remote Code Execution

Chamilo LMS File Upload Functionality Remote Code Execution

Chamilo LMS File Upload Functionality Remote Code Execution

Chamilo LMS File Upload Functionality Remote Code Execution

Chamilo: Authenticated Remote Code Execution via Unrestricted File Upload

Chamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCE

Chamilo LMS: Authenticated RCE via H5P Import

A Server-Side Request Forgery (SSRF) in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar file.

Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery (CSRF) via the edit_user function by targeting an admin user.

Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpoint

Chamilo: Error-based SQL Injection

Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. Non-admin users can manipulate sensitive profiles information, posing a significant risk to data integrity.

Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settings

Chamilo LMS: SQL Injection in the statistics AJAX endpoint

Session Fixation in Chamilo LMS

Chamilo LMS has Privilege Escalation via API User Role Modification

Chamilo: Stored XSS Vulnerability via CSV User Import

Chamilo: Deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters