An OS command injection vulnerability in Chamilo LMS allows authenticated administrators to achieve remote code execution on the underlying server.

This is an OS Command Injection (CWE-78) vulnerability located in the /plugin/vchamilo/views/editinstance.php file. It is triggered by sending a malicious payload through the POST main_database parameter by a user with administrative privileges.

The vulnerability carries a CVSS score of 7.2, reflecting a high impact on system integrity and availability. Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the web server user, which could result in full system compromise, data theft, or complete disruption of the learning management platform.

Immediate Action: Update Chamilo LMS to version 1.11.30 or later to apply the official security patch.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at the editinstance.php file, particularly those containing shell characters or unexpected string lengths in the main_database parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block suspicious input patterns in POST requests, specifically targeting OS command injection sequences.

Public Exploit Available: Unknown.

Given the severity of potential remote code execution, administrators should prioritize updating their Chamilo LMS instances to version 1.11.30 immediately. If an immediate update is not feasible, restrict access to the administrative dashboard to trusted IP addresses and monitor system logs for signs of unauthorized command execution.