A Cross-Site Request Forgery vulnerability in Chamilo LMS prior to version 1.11.34 permits unauthorized project deletion, posing a significant risk to course data integrity.

The application suffers from a Cross-Site Request Forgery (CWE-352) vulnerability because sensitive project deletion actions rely on GET requests and lack anti-CSRF tokens. An authenticated user with trainer privileges can be manipulated into executing these destructive actions by visiting a malicious link or page.

The ability for an unauthorized party to delete course projects presents a risk to academic continuity and data availability. With a CVSS score of 8.1, this vulnerability is categorized as High, reflecting the potential for significant impact on system integrity and user trust within the learning management environment.

Immediate Action: Upgrade Chamilo LMS to version 1.11.34 or later, which includes the necessary anti-CSRF protections to prevent unauthorized actions.

Proactive Monitoring: Monitor server access logs for unusual GET requests targeting project management endpoints, especially those originating from external referrers.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter suspicious traffic and restrict access to administrative functions to known, trusted IP ranges where possible.

Public Exploit Available: Unknown

Given the High severity rating and the potential for unauthorized data destruction, administrators should prioritize updating to version 1.11.34 immediately. Ensuring that all administrative and trainer accounts are aware of the risks associated with clicking untrusted links will further reduce the attack surface until the update is fully deployed.