CRITICAL🇵🇱 Wersja polska

CVE-2026-28430

CVSS 9.3v4.0pub. 2026-03-16upd. 2026-03-17

Chamilo LMS is a learning management system. Prior to version 1.11.34, there is an unauthenticated SQL injection vulnerability which allows remote attackers to execute arbitrary SQL commands via the custom_dates parameter. By chaining this with a predictable legacy password reset mechanism, an attacker can achieve full administrative account takeover without any prior credentials. The vulnerability also exposes the entire database, including PII and system configurations. This issue has been patched in version 1.11.34.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The attacker sends a crafted HTTP request containing a malicious payload in the custom_dates parameter, which is not properly validated or parameterized by the application — characteristic of CWE-89 (SQL injection). The injected SQL commands are executed directly on the database. By combining this vulnerability with a predictable password reset mechanism (legacy password reset), the attacker can, without any initial credentials, take full control over the administrator account.

Impact

The attacker gains unauthorized access to the entire database, including users' personal data (PII) and system configurations, and through the chain exploit can take full administrative control over the Chamilo LMS platform.

Mitigation & patch

Update Chamilo LMS to version 1.11.34, in which the vulnerability has been fixed. Details available in the official vendor references: https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34

Who is affected

Chamilo LMS in versions prior to 1.11.34

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X