Vulnerability · Published Mar 2, 2026 · Assigned by GitHub_M

CVE-2025-50188Error-based SQL Injection in Chamilo LMS

High 7.0

In plain English

A high-severity SQL injection in chamilo-lms from chamilo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 4.0)7.0High

Exploit odds (30 days)0.8%top 42.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the GET value parameter with the following scripts: /plugin/vchamilo/views/syncparams.php and /plugin/vchamilo/ajax/service.php, which allows an attacker to perform an attack aimed at modifying the database query logic by injecting an arbitrary SQL statements. This issue has been patched in version 1.11.30.

Affected products (as reported)

Vendor	Product	Versions
chamilo	chamilo-lms	< 1.11.30

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-96j3-x45m-9q3r x_refsource_CONFIRM
https://github.com/chamilo/chamilo-lms/commit/ef54cc0906a3caaa3e7ac9b640b044f03b1fe733 x_refsource_MISC
https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 x_refsource_MISC