CVE-2025-50189 - Vulnerability Analysis
HighCVSS: 8.8Last Updated: March 3, 2026
Chamilo - SQL Injection
Published: March 2, 2026Updated: March 3, 2026PoC AvailableRemote Exploitable
Overview
Chamilo < 1.11.30 contains a SQL injection caused by insufficient validation of POST resource[document][SQL_INJECTION_HERE] and POST login parameters in /main/coursecopy/copy_course_session_selected.php, letting attackers modify database query logic remotely, exploit requires crafted POST requests.
Severity & Score
Severity: High
CVSS Score: 8.8
Impact
Attackers can modify database queries, potentially leading to data modification or unauthorized data access.
Mitigation
Upgrade to version 1.11.30 or later.
References
- https://github.com/chamilo/chamilo-lms/commit/22bb81df8f7062da20a2f6248789f47b221ca705
- https://github.com/chamilo/chamilo-lms/commit/75ab03c938adc48a3cd8234d98fc340e1998aa81
- https://github.com/chamilo/chamilo-lms/commit/7903cef2eb41817c11a52ba6ac34a1d454bc5ef7
- https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30
- https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-vxx3-648j-7p4r
Related Resources
Details
- CVE ID
- CVE-2025-50189
- Severity
- High
- CVSS Score
- 8.8
- Type
- sql_injection
- Status
- confirmed
CWE
- CWE-89
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H