An SQL injection vulnerability in Chamilo LMS versions prior to 1.11.30 allows authenticated attackers to manipulate database queries, potentially leading to unauthorized data access or system compromise.

The application fails to properly validate user-supplied input within the POST parameters of the /main/coursecopy/copy_course_session_selected.php script. This flaw allows an authenticated attacker to inject arbitrary SQL statements, thereby altering the intended database query logic.

Successful exploitation of this vulnerability can lead to the unauthorized disclosure or corruption of sensitive institutional data stored within the learning management system. Given the CVSS score of 8.8, this is a high-severity issue that could result in significant operational disruption and a breach of data confidentiality. Organizations relying on Chamilo for academic or corporate training must treat this as a priority to prevent potential database-level compromise.

Immediate Action: Update the Chamilo LMS installation to version 1.11.30 or later, as this release includes the necessary input validation fixes.

Proactive Monitoring: Review database access logs for unusual query patterns or syntax errors that may indicate injection attempts targeting the course copy module.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads directed at the vulnerable PHP endpoint.

Public Exploit Available: No (exploit_available: unknown)

The vulnerability presents a significant risk to the integrity of the Chamilo platform. Administrators should prioritize the update to version 1.11.30 immediately to eliminate the underlying flaw. Until the patch is applied, ensure that access to the learning management system is strictly restricted to trusted users to mitigate the risk of exploitation by malicious actors.