PT-2026-25797 · Chamilo · Chamilo Lms

Kr1Shna4Garwal · Published 2026-03-16 · Updated 2026-03-18 · CVE-2026-28430

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 1.11.34

Description Chamilo LMS is a learning management system. Prior to version 1.11.34, an unauthenticated SQL injection issue exists, allowing remote attackers to execute arbitrary SQL commands through the custom dates parameter. This can be chained with a predictable legacy password reset mechanism, enabling full administrative account takeover without prior credentials. The vulnerability also exposes the entire database, including Personally Identifiable Information (PII) and system configurations.

Recommendations Versions prior to 1.11.34 should be updated to version 1.11.34 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-28430

GHSA-84GW-QJW9-V8JV

Affected Products

Chamilo Lms

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28430.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-84gw-qjw9-v8jv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28430 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28430 · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34 · Note
• https://twitter.com/TheHackerWire/status/2034404421329904065 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2033781746429313209 · Twitter Post
• https://twitter.com/CVEnew/status/2033755325526929639 · Twitter Post
• https://twitter.com/0dayPublishing/status/2033625384072196547 · Twitter Post