An insecure direct object reference vulnerability in Chamilo LMS allows any authenticated user to maliciously manipulate the course progress and completion status of other users.

The application utilizes an insecure direct object reference (IDOR) flaw within the lp_ajax_save_item.php file, which processes a user-supplied uid parameter without validating that the requester owns the target resource. This allows any authenticated user to overwrite the score, status, and completion time of any other user's learning path.

The ability for students to manipulate their own or others' academic progress records presents a significant risk to the integrity of institutional data and certification processes. With a CVSS score of 7.1, this high severity vulnerability could lead to fraudulent academic outcomes, unauthorized modification of records, and the degradation of trust in the learning management system.

Immediate Action: Update Chamilo LMS to version 1.11.38 or 2.0.0-RC.3 immediately to address the missing authorization checks.

Proactive Monitoring: Review application access logs for unusual patterns of requests to lp_ajax_save_item.php, specifically identifying sessions that frequently modify multiple distinct user IDs.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and restrict requests to the lp_ajax_save_item.php endpoint if they contain unexpected user ID parameters or originate from unauthorized sessions.

Public Exploit Available: Unknown

Given the high impact on data integrity and the availability of a proof-of-concept, organizations should prioritize upgrading their Chamilo LMS installations to the patched versions. Failure to apply these updates leaves the system vulnerable to unauthorized manipulation of academic records, which may have long-term consequences for compliance and institutional reporting.