A stored cross-site scripting flaw in Chamilo LMS allows authenticated teacher accounts to compromise administrator sessions and execute unauthorized actions.

The application is susceptible to a stored cross-site scripting (CWE-79) vulnerability within the glossary function. This flaw allows an authenticated user with the Teacher role to inject malicious JavaScript, which executes when viewed by an administrator, potentially leading to unauthorized session manipulation.

The exploitation of this vulnerability poses a significant risk to the integrity and confidentiality of the learning management system. By targeting administrative accounts, an attacker could potentially gain elevated control over the platform, modify system settings, or access sensitive course and user data. The CVSS score of 8.3 reflects the high impact on confidentiality and integrity, necessitating prompt remediation to prevent administrative account compromise.

Immediate Action: Upgrade Chamilo LMS to version 1.11.30 or later to apply the necessary input sanitization patches.

Proactive Monitoring: Audit administrative access logs and monitor the glossary function for suspicious script injections or unusual character sequences.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to detect and block common XSS payloads targeting the glossary endpoint.

Public Exploit Available: Unknown

Given the potential for administrative account compromise, organizations should prioritize upgrading their Chamilo LMS instances to version 1.11.30 immediately. Administrators should also conduct a review of existing glossary entries to ensure no malicious payloads have been previously injected. Applying the patch is the only definitive method to eliminate this cross-site scripting risk.