PT-2026-25797 · Chamilo · Chamilo Lms

Kr1Shna4Garwal · Publicado 2026-03-16 · Atualizado 2026-03-18 · CVE-2026-28430

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 1.11.34

Description Chamilo LMS is a learning management system. Prior to version 1.11.34, an unauthenticated SQL injection issue exists, allowing remote attackers to execute arbitrary SQL commands through the custom dates parameter. This can be chained with a predictable legacy password reset mechanism, enabling full administrative account takeover without prior credentials. The vulnerability also exposes the entire database, including Personally Identifiable Information (PII) and system configurations.

Recommendations Versions prior to 1.11.34 should be updated to version 1.11.34 or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-28430

GHSA-84GW-QJW9-V8JV

Produtos afetados

Chamilo Lms

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28430.json · Exploit
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34 · Nota
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-84gw-qjw9-v8jv · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-28430 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2034404421329904065 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2033781746429313209 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-28430 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2033755325526929639 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2033625384072196547 · Publicação no Twitter