A critical OS command injection vulnerability in Chamilo LMS allows authenticated administrators to execute arbitrary system commands, potentially leading to full system compromise.

This vulnerability is an OS command injection flaw (CWE-78) located in the /plugin/vchamilo/views/manage.controller.php file. The vulnerability requires high privileges (authenticated administrator) to trigger, as indicated by the CVSS vector PR:H.

The ability to execute arbitrary OS commands poses a severe risk to the confidentiality, integrity, and availability of the learning management system. Successful exploitation could allow an attacker to gain persistent access to the underlying server, exfiltrate sensitive student or faculty data, or disrupt educational services. Given the CVSS score of 7.2, this vulnerability represents a significant security risk that requires prompt attention.

Immediate Action: Upgrade Chamilo LMS to version 1.11.30 or later to apply the official security patch.

Proactive Monitoring: Review system access logs for unusual administrative activity and monitor for unexpected process executions originating from the web server user.

Compensating Controls: Ensure the application is running with the principle of least privilege, restricting the permissions of the web server service account to limit the potential impact of a successful command injection.

Public Exploit Available: Unknown

The presence of an OS command injection vulnerability in a widely used learning management system necessitates immediate remediation. Administrators should prioritize upgrading to version 1.11.30 to eliminate the injection vector. While the vulnerability requires administrative privileges, the potential for total system takeover makes patching an urgent security requirement to prevent unauthorized access and potential data breaches.