An OS Command Injection vulnerability in Chamilo LMS allows authenticated administrators to execute arbitrary commands on the underlying server, posing a significant risk of system compromise.

The vulnerability is an OS Command Injection (CWE-78) located within the /main/cron/lang/check_parse_lang.php file. The flaw requires high privileges (authenticated administrator) to trigger the vulnerable function.

The ability to execute arbitrary OS commands on the server hosting the learning management system can lead to full system compromise, data exfiltration, and unauthorized lateral movement within the network. Given the CVSS score of 7.2, this vulnerability is classified as High severity because it provides an attacker with the capability to perform destructive actions or gain persistent access to the host environment.

Immediate Action: Update Chamilo LMS to version 1.11.30 or later immediately to incorporate the vendor-provided patch.

Proactive Monitoring: Review web server access and error logs for unusual requests directed at the /main/cron/lang/ directory, specifically looking for shell-related characters or unexpected script execution patterns.

Compensating Controls: Implement strict file permission controls on the web root and ensure the web application service account operates with the least privilege necessary to limit the impact of potential command injection.

Public Exploit Available: No (exploit_available: unknown)

Organizations utilizing Chamilo LMS should prioritize upgrading to version 1.11.30 to remediate this command injection flaw. While the vulnerability requires administrative access, the potential for total system compromise necessitates prompt action to secure the environment against potential exploitation.