A critical SQL injection vulnerability in Chamilo LMS allows authenticated attackers to perform unauthorized database operations and data extraction.

The vulnerability exists in the statistics AJAX endpoint where the date_start and date_end parameters are improperly sanitized. An authenticated attacker can bypass intended security controls because the database escaping mechanism is neutralized by a secondary string replacement function, allowing for arbitrary SQL injection.

Successful exploitation of this vulnerability could lead to significant data compromise, as an attacker can perform blind time-based and conditional data extraction from the underlying database. With a CVSS score of 8.8, this flaw represents a high-severity risk that could lead to full unauthorized access to sensitive institutional or user data stored within the learning management system.

Immediate Action: Update Chamilo LMS to version 1.11.36 or later to apply the necessary security patches and fix the flawed input sanitization logic.

Proactive Monitoring: Review web server and application access logs for suspicious activity involving the statistics AJAX endpoint, particularly requests containing unusual characters or SQL syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP requests until the application can be updated.

Public Exploit Available: Unknown.

Given the high CVSS score and the potential for complete data compromise, organizations utilizing Chamilo LMS should prioritize this update immediately. Ensure that all systems are upgraded to version 1.11.36 to eliminate the underlying injection vector and secure the database against unauthorized access.