An OS command injection vulnerability in Chamilo LMS versions prior to 1.11.30 presents a high risk of unauthorized system-level command execution by authenticated administrators.

This vulnerability is an OS Command Injection (CWE-78) located in the /main/admin/sub_language_ajax.inc.php file. It is triggered via the POST new_language parameter and requires administrative-level authentication to exploit.

Successful exploitation of this flaw allows an attacker with administrative access to execute arbitrary operating system commands, potentially leading to full system compromise. Given the CVSS score of 7.2, this vulnerability represents a significant risk to the confidentiality, integrity, and availability of the learning management system and the underlying server infrastructure.

Immediate Action: Upgrade Chamilo LMS to version 1.11.30 or later to apply the necessary security patches.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting the sub_language_ajax.inc.php endpoint, particularly those containing shell metacharacters.

Compensating Controls: Implement strict administrative access controls and utilize a Web Application Firewall (WAF) to filter malicious input patterns targeting administrative endpoints if immediate patching is not feasible.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing Chamilo LMS must prioritize the update to version 1.11.30 to remediate this command injection flaw. While the vulnerability requires administrative access, the potential for total system compromise necessitates immediate action to secure the administrative interface against malicious exploitation.