CVE-2025-50188 - Vulnerability Analysis

Overview

Chamilo < 1.11.30 contains a SQL injection caused by insufficient validation of GET 'value' parameter in /plugin/vchamilo/views/syncparams.php and /plugin/vchamilo/ajax/service.php, letting attackers modify database queries remotely, exploit requires crafted request.

Severity & Score

Impact

Attackers can modify database queries, potentially leading to data disclosure, modification, or full system compromise.

Mitigation

Update to version 1.11.30 or later.

References

• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-96j3-x45m-9q3r
• https://github.com/chamilo/chamilo-lms/commit/ef54cc0906a3caaa3e7ac9b640b044f03b1fe733

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner