Chamilo Learning Management System Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Chamilo Learning Management System versions prior to 1.11.30. The issue arises from inadequate sanitization of the page parameter in the session/add_users_to_session.php endpoint, allowing for the injection of malicious scripts.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the session/add_users_to_session.php endpoint with a crafted page parameter that includes JavaScript execution, such as an 'onmouseover' event. The injected script will execute when the mouse hovers over the element, demonstrating the cross-site scripting vulnerability.

Remediation

Users can upgrade to Chamilo version 1.11.30 or later to address this vulnerability.