Chamilo LMS Stored Cross-Site Scripting Vulnerability Allowing Account Takeover

A stored cross-site scripting vulnerability has been identified in Chamilo LMS versions prior to 1.11.34. This issue allows an attacker to inject arbitrary JavaScript into the platform's social network and internal messaging features. The injected script executes in the browser of any authenticated user, including administrators, within the context of the LMS. This vulnerability could lead to full account takeover through session hijacking, unauthorized actions using the victim's privileges, exfiltration of sensitive data, and potential self-propagation to other users.

Impact

Exploitation of this vulnerability allows for session hijacking, leading to unauthorized access to the victim's account and privileges. It also enables the exfiltration of sensitive data and the potential for the injected script to propagate to other users.

Remediation

Users can upgrade to Chamilo LMS version 1.11.34 to address this vulnerability.