A critical eval injection vulnerability in Chamilo LMS allows authenticated administrators to achieve remote code execution on the underlying server.

The PlatformConfigurationController::decodeSettingArray() method improperly uses PHP's eval() function to parse database settings. This flaw allows an attacker with administrative access to inject malicious PHP code, which is subsequently executed when the system processes configuration data.

The vulnerability carries a CVSS score of 8.8, indicating a high risk of total system compromise. Successful exploitation grants the attacker the ability to execute arbitrary code with the permissions of the web server user, leading to potential data exfiltration, unauthorized system modification, and complete loss of server confidentiality, integrity, and availability.

Immediate Action: Update Chamilo LMS to version 2.0.0-RC.3 or later to resolve the improper neutralization of dynamically evaluated code.

Proactive Monitoring: Monitor system logs for unusual PHP execution patterns or modifications to platform configuration settings in the database.

Compensating Controls: Implement strict database access controls to prevent unauthorized modification of configuration settings and employ a Web Application Firewall (WAF) to block suspicious input patterns targeting configuration endpoints.

Public Exploit Available: Unknown.

Given the severity of this remote code execution flaw, organizations running affected versions of Chamilo LMS must prioritize patching to version 2.0.0-RC.3 immediately. Failure to update leaves the application susceptible to full administrative takeover, and administrators should conduct a thorough audit of their instance for any signs of unauthorized configuration changes or malicious activity.