Chamilo Learning Management System Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Chamilo Learning Management System versions prior to 1.11.30. The issue resides in the admin/user_list.php endpoint, where the keyword_inactive parameter is inadequately sanitized. This flaw allows attackers to inject malicious JavaScript by crafting a specific URL.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the admin/user_list.php endpoint with a crafted keyword_inactive parameter that includes JavaScript payloads. The lack of proper sanitization will allow the injected script to execute, demonstrating the cross-site scripting vulnerability.

Remediation

Users can upgrade to Chamilo version 1.11.30 or later, where this vulnerability has been patched.