A session fixation vulnerability in Chamilo LMS allows unauthenticated remote attackers to hijack user sessions, posing a significant risk to account integrity.

The vulnerability exists in the main/lp/aicc_hacp.php file, where user-controlled request parameters are used to set the PHP session ID before the global bootstrap is loaded. This allows an unauthenticated attacker to force a known session ID onto a victim, leading to potential session fixation.

Successful exploitation allows an attacker to hijack active user sessions, including those belonging to administrative accounts. This compromise can lead to unauthorized data access, modification of educational content, and complete system takeover, justifying the CVSS score of 7.5.

Immediate Action: Update Chamilo LMS to version 1.11.38 or 2.0.0-RC.3 to apply the necessary security patches.

Proactive Monitoring: Review web server and application access logs for anomalous session-related requests or patterns suggesting attempted session manipulation.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious requests directed at the /main/lp/aicc_hacp.php endpoint.

Public Exploit Available: No (exploit_available: false)

Given the potential for full account takeover, organizations running affected versions of Chamilo LMS must prioritize upgrading to the patched releases. Immediate action is required to prevent unauthorized access to sensitive institutional data and to maintain the integrity of the learning management environment.