Vulnerability details

CVE-2025-50189

chamilo chamilo-lms

Chamilo: Error-based SQL Injection

CVSS 4.0

7.2High

Official description

Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the POST resource[document][SQL_INJECTION_HERE] and POST login parameters found in /main/coursecopy/copy_course_session_selected.php, which allows an attacker to perform an attack aimed at modifying the database query logic by injecting an arbitrary SQL statements. This issue has been patched in version 1.11.30.

CVSS scores

Score	Version	Source	Vector
7.2High	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N`

Affected products

Vendor	Product	Versions	Source
chamilo	chamilo-lms	< 1.11.30	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-vxx3-648j-7p4r x_refsource_CONFIRM
https://github.com/chamilo/chamilo-lms/commit/22bb81df8f7062da20a2f6248789f47b221ca705 x_refsource_MISC
https://github.com/chamilo/chamilo-lms/commit/75ab03c938adc48a3cd8234d98fc340e1998aa81 x_refsource_MISC
https://github.com/chamilo/chamilo-lms/commit/7903cef2eb41817c11a52ba6ac34a1d454bc5ef7 x_refsource_MISC
https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-03-02
Last updated: 2026-03-02
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.83%

Probability of exploitation in 30 days

57.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')