A critical OS command injection vulnerability in Chamilo LMS allows authenticated administrators to execute arbitrary commands on the underlying server, posing a significant risk of system compromise.

The application is susceptible to OS command injection (CWE-78) within the /plugin/vchamilo/views/import.php endpoint. By manipulating the to_main_database POST parameter, an authenticated user with administrative privileges can inject malicious commands that are executed by the server with the privileges of the web application process.

The ability to execute arbitrary OS commands provides an attacker with full control over the affected server, potentially leading to unauthorized data exfiltration, lateral movement within the network, or complete system destruction. With a CVSS score of 7.2, this vulnerability represents a high-severity threat that directly impacts the confidentiality, integrity, and availability of the learning management platform and its associated databases.

Immediate Action: Upgrade Chamilo LMS to version 1.11.30 or later, as this release includes the necessary security patches to neutralize the command injection vector.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at /plugin/vchamilo/views/import.php, specifically monitoring for unusual characters or command strings within the to_main_database parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block malicious input containing shell metacharacters in HTTP POST requests.

Public Exploit Available: No (Exploit available: unknown)

Given the severity of OS command injection and the availability of a vendor-supplied patch, organizations must prioritize upgrading their Chamilo LMS instances to version 1.11.30 immediately. Administrators should verify the integrity of their environments for any signs of unauthorized access, as the existence of a proof-of-concept increases the likelihood of opportunistic exploitation attempts in the near term.