An SQL injection vulnerability in Chamilo LMS versions prior to 1.11.30 allows an authenticated administrative attacker to execute arbitrary SQL commands against the database.

The application fails to properly validate input provided to the GET value parameters within the syncparams.php and service.php scripts, enabling SQL injection. This vulnerability requires the attacker to hold administrative privileges to successfully trigger the flaw.

The ability to inject arbitrary SQL statements poses a severe risk to the confidentiality and integrity of the learning management system. Successful exploitation could lead to unauthorized data extraction, modification of sensitive user records, or potential disruption of service. With a CVSS score of 7.2, this vulnerability is classified as High, reflecting the significant impact on database security and the potential for complete compromise of the application data layer.

Immediate Action: Upgrade Chamilo LMS to version 1.11.30 or later to apply the necessary input validation patches.

Proactive Monitoring: Inspect web access logs for anomalous GET requests targeting the /plugin/vchamilo/ directory, specifically looking for SQL syntax patterns or unexpected parameter values.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP GET requests.

Public Exploit Available: Unknown.

Given the high severity of this SQL injection flaw and the existence of a proof-of-concept, organizations must prioritize the update to version 1.11.30. Administrators should verify the integrity of their database after patching to ensure no unauthorized modifications have occurred, and restrict administrative access to the affected plugin endpoints as a defensive measure.