Executive brief
Chamilo LMS, a popular open-source learning management system, is vulnerable to a session fixation flaw. This security weakness allows an attacker to pre-determine a user's session identifier, potentially leading to full account takeover if a victim logs in using the compromised session. Successful exploitation could result in the theft of student or teacher data and unauthorized access to educational materials.
Technical details
A session fixation vulnerability exists in Chamilo LMS prior to versions 1.11.38 and 2.0.0-RC.3 within the 'main/lp/aicc_hacp.php' file. The application directly uses user-controlled request parameters ('aicc_sid' or 'session_id') to set the PHP session ID via the session_id() function before the global bootstrap and authentication checks occur. Because this endpoint allows anonymous access, an attacker can force a victim to use a known session ID. If the victim subsequently authenticates, the attacker can use the pre-defined ID to hijack the authenticated session. The issue has been addressed by deprecating and disabling the affected AICC support functionality.
Affected products
- Chamilo Chamilo LMS < 1.11.38, < 2.0.0-RC.3
Timeline
- 2026-04-10: disclosed
- 2026-04-10: advisory
- 2026-04-10: patched