A stored XSS vulnerability in Chamilo LMS versions prior to 1.11.34 permits authenticated attackers to hijack user sessions and execute unauthorized actions with the privileges of the victim.

This is a stored Cross-site Scripting (CWE-79) vulnerability located within the social network and internal messaging features of the platform. An attacker with authenticated access can inject arbitrary JavaScript that executes in the browser of any user, including administrators, who views the compromised content.

The impact of this vulnerability is severe, as it enables full account takeover via session hijacking and the exfiltration of sensitive educational data. Given the CVSS score of 8.8, this flaw poses a high risk to organizational integrity and data confidentiality, particularly because it can be used to escalate privileges if an administrator views the malicious payload.

Immediate Action: Update Chamilo LMS to version 1.11.34 or later to apply the necessary input sanitization patches.

Proactive Monitoring: Review web server access logs for anomalous requests to messaging endpoints and monitor for unusual JavaScript execution patterns within the platform.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS payloads in POST requests until the application update is fully deployed.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing Chamilo LMS must prioritize the update to version 1.11.34 immediately. Because this vulnerability allows for the compromise of administrative accounts, delaying the patch significantly increases the risk of a platform-wide security incident. Please schedule this update within the next maintenance window to effectively mitigate the risk of session hijacking and unauthorized data access.