CVE-2026-33714
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Chamilo LMS version 2.0.0-RC.2 has a SQL injection vulnerability in the statistics AJAX endpoint, an incomplete fix for CVE-2026-30881. The date_start and date_end parameters in the users_active action are unsanitized, allowing an authenticated admin to perform time-based blind SQL injection and extract arbitrary data.
Risk Assessment
The risk is extraction of sensitive database data by an admin, potentially compromising system confidentiality.
Recommendation
Upgrade Chamilo LMS to version 2.0.0, which contains the complete fix.
Other vulnerabilities in Chamilo
See all- CVE-2023-34960Critical
A command injection vulnerability in the wsConvertPpt component of Chamilo versions 1.11.* through 1.11.18. An attacker can execute arbitrary system commands via a SOAP API call with a crafted PowerPoint filename.
- CVE-2023-34944Critical
An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo versions 1.11.* up to 1.11.18 allows attackers to upload crafted SVG files. This can lead to arbitrary code execution on the server.
- CVE-2026-34239High
Vulnerability in Chamilo version 1.11.40 and earlier. An authenticated user enrolled in a course (student, teacher, DRH) can remotely execute code in the main/inc/ajax/lang.ajax.php path, which is protected only by api_protect_course_script(true).
- CVE-2023-39061Low
A CSRF vulnerability in Chamilo versions 1.11 through 1.11.20 allows a remote authenticated privileged attacker to execute arbitrary code. The flaw is due to missing cross-site request forgery protections.
- CVE-2023-37066Medium
Chamilo versions 1.11.x up to 1.11.20 allow users with admin privileges to insert XSS in the skills wheel.
- CVE-2023-37062Medium
Chamilo versions 1.11.x up to 1.11.20 allow users with admin privilege accounts to insert XSS in the course categories' definition.
Original NVD description (English source)
Chamilo is an open-source learning management system (LMS). Version 2.0.0-RC.2 contains a SQL Injection vulnerability in the statistics AJAX endpoint, which is an incomplete fix for CVE-2026-30881. While CVE-2026-30881 was patched by applying Security::remove_XSS() to the date_start and date_end parameters in the get_user_registration_by_month action, the same parameters remain unsanitized in the users_active action within the same file (public/main/inc/ajax/statistics.ajax.php), where they are directly interpolated into a SQL query. An authenticated admin can exploit this to perform time-based blind SQL injection, enabling extraction of arbitrary data from the database. This issue has been fixed in version 2.0.0.