PT-2025-35788 · Unknown · Chamilo Lms

Published 2025-04-01 · Updated 2026-03-07 · CVE-2025-50189

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 1.11.30

Description The Chamilo LMS system has an issue due to inadequate validation of XML object sequences. Successful exploitation could allow a remote attacker to execute arbitrary SQL queries. The application does not sufficiently validate data received from the user via the document POST resource and login POST parameters in the '/main/coursecopy/copy course session selected.php' file, enabling an attacker to modify database query logic by injecting arbitrary SQL statements. The vulnerable parameter is SQL INJECTION HERE.

Recommendations Update to version 1.11.30 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-06902

CVE-2025-50189

GHSA-VXX3-648J-7P4R

Affected Products

Chamilo Lms

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/50xxx/CVE-2025-50189.json · Exploit
• 🔥 https://github.com/chamilo/chamilo-lms/wiki/security-issues#issue-184---2025-04-16---high-impact-moderate-risk---error-based-sql-injection-in-course-copy-cve-2025-50189 · Exploit
• https://github.com/chamilo/chamilo-lms/commit/75ab03c938adc48a3cd8234d98fc340e1998aa81 · Patch
• https://github.com/chamilo/chamilo-lms/commit/7903cef2eb41817c11a52ba6ac34a1d454bc5ef7 · Patch
• https://github.com/chamilo/chamilo-lms/commit/22bb81df8f7062da20a2f6248789f47b221ca705 · Patch
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-vxx3-648j-7p4r · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06902 · Security Note
• https://osv.dev/vulnerability/CVE-2025-50189 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-50189 · Security Note
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 · Note
• https://twitter.com/VulmonFeeds/status/2028545321626722808 · Twitter Post
• https://twitter.com/cracbot/status/2030237094329880585 · Twitter Post
• https://twitter.com/cracbot/status/2029512337380782450 · Twitter Post
• https://twitter.com/cracbot/status/2029874793756107248 · Twitter Post
• https://twitter.com/infoflowcloud/status/2028502043707470134 · Twitter Post