Chamilo LMS blind SQL injection via admin session filter
An administrator on the online course program can peek at member data.
Summary
Chamilo LMS, an open-source learning management system, lets a logged-in administrator manipulate database queries. Versions before 1.11.40 and from 2.0.0 before 2.0.1 are affected.
Affected when
- logged in as an authenticated administrator
- versions before 1.11.40, or 2.0.0 up to before 2.0.1
What to do
Update to version 1.11.40 or 2.0.1.
Update to at least the version for your product:
- Chamilo LMS 1.11 1.11.40 or later
- Chamilo LMS 2.0 2.0.1 or later
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen