Chamilo LMS Unauthenticated SQL Injection Vulnerability Allowing Administrative Account Takeover

A critical unauthenticated SQL injection vulnerability has been identified in Chamilo LMS versions prior to 1.11.34. This vulnerability allows remote attackers to execute arbitrary SQL commands via the custom_dates parameter. Exploiting this flaw, in conjunction with a predictable legacy password reset mechanism, an attacker can take over an administrative account without any prior credentials. Additionally, this vulnerability exposes the entire database, including personal identifiable information (PII) and system configurations.

Impact

Exploitation of this vulnerability allows for unauthorized access to the entire database, including student PII, teacher credentials, financial data, and course information.

Remediation

Users can upgrade to Chamilo LMS version 1.11.34 or 2.0 to address this vulnerability.