Chamilo LMS: Conditional PHP execution through vendored QuickForm eval
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.11.40, 2.0.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Chamilo LMS, an open-source learning management system, is affected, specifically its 1.x releases before 1.11.40 and 2.x releases before 2.0.1, through a bundled form library that can run arbitrary PHP code when form field names contain attacker-controlled input. Standard Chamilo forms are not exposed by default, but where a custom plugin or misconfiguration passes user input into those field names, an attacker could gain full control of the server.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple `eval()` calls in the vendored PEAR `HTML_QuickForm` libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms use hardcoded element names; exploitation requires a developer-specific plugin or misconfiguration that lets user input reach those element names. Where that conditional path exists, the impact can be full server compromise. This issue is fixed in versions 1.11.40 and 2.0.1.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- chamilo chamilo-lms
fixed in 1.11.40; From 2.0.0-alpha.1 · fixed in 2.0.1