A stored cross-site scripting vulnerability in Chamilo LMS allows remote attackers to execute arbitrary code within an authenticated user session.

This vulnerability involves improper neutralization of input during web page generation (CWE-79) within the CSV user data import function. Specifically, insufficient sanitization of the Last Name, First Name, and Username fields allows an attacker to inject stored XSS payloads that execute when an administrator or user views the affected profile.

Successful exploitation of this vulnerability allows an attacker to execute malicious scripts in the context of an authenticated user session. Given the CVSS score of 8.8, this flaw poses a significant risk to data integrity and confidentiality, as an attacker could potentially hijack user sessions, modify data, or perform unauthorized actions within the learning management system.

Immediate Action: Upgrade Chamilo LMS to version 1.11.30 or later, which includes the necessary input sanitization patches.

Proactive Monitoring: Review web server access logs for anomalous requests to profile pages and monitor for unusual activity originating from user accounts that frequently interact with CSV imports.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to detect and block common XSS injection patterns in HTTP requests, particularly those involving file uploads or data import endpoints.

Public Exploit Available: Unknown.

Given the high CVSS severity and the confirmed existence of proof-of-concept material, organizations running Chamilo LMS must prioritize the update to version 1.11.30. Failure to patch leaves the platform vulnerable to session hijacking and unauthorized data manipulation, which could severely compromise the integrity of the learning environment.