Chamilo LMS versions prior to 1.11.30 are vulnerable to an error-based SQL injection that may allow an authenticated attacker with high privileges to compromise database integrity.

This is an SQL injection vulnerability (CWE-89) located in the /main/exercise/hotpotatoes.php script. The vulnerability is triggered via the userFile parameter in a POST request and requires high privileges (PR:H) to exploit.

Successful exploitation of this SQL injection vulnerability could allow an attacker to extract sensitive information from the backend database or manipulate application logic. Given the CVSS score of 7.2, the risk is classified as High, reflecting the potential for significant data loss or unauthorized access to the learning management system records.

Immediate Action: Update Chamilo LMS to version 1.11.30 or later to include the vendor-supplied security patch.

Proactive Monitoring: Review web server and application error logs for suspicious POST requests directed at hotpotatoes.php, specifically looking for SQL syntax errors.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP POST parameters.

Public Exploit Available: No (exploit_available: unknown)

The presence of a known proof-of-concept for this SQL injection flaw necessitates prompt action. Administrators should prioritize upgrading to version 1.11.30 immediately to eliminate the vulnerable code path and protect the integrity of the Chamilo LMS environment.