Executive brief
Chamilo is an open-source learning management system used by educational institutions and businesses to deliver online training. A security flaw in the statistics reporting tool allows an administrator to run unauthorized database commands. This could lead to the theft of sensitive user data or the disruption of the learning platform's operations.
Technical details
A SQL injection vulnerability exists in Chamilo LMS 2.0.0-RC.2 within the 'users_active' action of the statistics AJAX endpoint (public/main/inc/ajax/statistics.ajax.php). The 'date_start' and 'date_end' parameters are directly interpolated into a SQL query without sanitization or parameterized queries. This represents an incomplete fix for a previous vulnerability (CVE-2026-30881), where sanitization was applied to one action but missed in another within the same file. An authenticated attacker with administrative privileges can exploit this via network requests to perform time-based blind SQL injection, allowing for arbitrary data extraction from the database. The issue is resolved in version 2.0.0.
Affected products
- Chamilo Chamilo LMS 2.0.0-RC.2
Timeline
- 2026-04-14: disclosed
- 2026-04-14: advisory
- 2026-04-14: patched