SQL Injection Vulnerability in Chamilo Learning Management System by Chamilo

CVE-2026-30881

What is CVE-2026-30881?

Chamilo LMS is susceptible to an SQL Injection vulnerability that arises from improper handling of user-supplied data in the statistics AJAX endpoint. Specifically, the parameters date_start and date_end are transmitted via $_REQUEST and incorporated into a SQL string without adequate sanitization. Despite a call to Database::escape_string(), the output is compromised by a subsequent str_replace operation, which effectively restores any injected single quotes. This oversight permits authenticated attackers to submit arbitrary SQL queries, facilitating both blind time-based and conditional data retrieval from the database. Users are advised to update to version 1.11.36, where this issue has been resolved.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References