PT-2026-25801 · Chamilo · Chamilo Lms

Elliszat · Publicado 2026-03-16 · Atualizado 2026-03-17 · CVE-2026-30881

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 1.11.36

Description Chamilo LMS is a learning management system that has a SQL Injection issue in the statistics AJAX endpoint. The date start and date end parameters from the $ REQUEST array are directly embedded into a raw SQL string without proper sanitization. The Database::escape string() function is called, but its output is neutralized, bypassing the escaping mechanism and allowing an authenticated attacker to inject arbitrary SQL statements into the database query. This enables blind time-based and conditional data extraction. The vulnerable API endpoint is '/statistics'.

Recommendations Versions prior to 1.11.36 should be updated to version 1.11.36 or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-30881

GHSA-5GGX-X2CV-4H44

Produtos afetados

Chamilo Lms

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30881.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-5ggx-x2cv-4h44 · Aviso do Fabricante
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-30881 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-30881 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2033768947498029334 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2033755322569883817 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2033645238565101699 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2033645771317461319 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2033645353795264664 · Publicação no Twitter