Chamilo: OS command Injection in /plugin/vchamilo/views/import.php with the POST to_main_database parameter
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 2.6%
exploitation probability
2.6%top 16% of all CVEs
observed exploitation
nono source reports it
In short
Chamilo learning management system versions before 1.11.30 allow attackers to execute arbitrary system commands through the to_main_database parameter in the import.php file, potentially compromising the entire server.
Technical detail
OS command injection vulnerability in /plugin/vchamilo/views/import.php allows unauthenticated or authenticated attackers to execute arbitrary operating system commands via unsanitized POST parameter to_main_database. Exploitation requires network access to the vulnerable endpoint; successful exploitation grants command execution with web server process privileges.
Summary generated and translated by AI from the official description.
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS command Injection vulnerability in /plugin/vchamilo/views/import.php with the POST to_main_database parameter. This issue has been patched in version 1.11.30.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
chamilo · chamilo-lms