CVE-2021-34187
📋 TL;DR
This SQL injection vulnerability in Chamilo LMS allows attackers to execute arbitrary SQL commands via the searchField, filters, or filters2 parameters in the model.ajax.php endpoint. It affects all Chamilo installations through version 1.11.14, potentially enabling unauthorized data access, modification, or deletion.
💻 Affected Systems
- Chamilo LMS
📦 What is this software?
Chamilo by Chamilo
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or remote code execution via database functions.
Likely Case
Unauthorized access to sensitive user data, course materials, and administrative information stored in the database.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
The vulnerability is well-documented with public proof-of-concept references, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Chamilo 1.11.15 and later
Vendor Advisory: https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-67-2021-05-27-High-impact-very-high-risk-Unauthenticated-SQL-injection
Restart Required: No
Instructions:
1. Backup your Chamilo installation and database. 2. Update to Chamilo 1.11.15 or later. 3. Apply the security patches from the GitHub commits. 4. Verify the fix by testing the vulnerable endpoints.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for searchField, filters, and filters2 parameters to block SQL injection attempts.
Modify main/inc/ajax/model.ajax.php to sanitize user inputs before processing
Web Application Firewall Rule
allBlock requests containing SQL injection patterns targeting the model.ajax.php endpoint.
Configure WAF to block patterns like UNION SELECT, OR 1=1, --, ;, etc. in parameters
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries in the affected PHP file
- Restrict access to the model.ajax.php endpoint using IP whitelisting or authentication requirements
🔍 How to Verify
Check if Vulnerable:
Test the /main/inc/ajax/model.ajax.php endpoint with SQL injection payloads in searchField, filters, or filters2 parameters and observe database errors or unexpected responses.Check Version:
Check the Chamilo version in the admin panel or review the main/inc/conf/configuration.php file for version information.Verify Fix Applied:
After patching, test the same endpoint with SQL injection payloads and verify they are rejected or properly sanitized without database errors.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in web server logs
- Multiple requests to model.ajax.php with suspicious parameter values
- Database query patterns containing UNION, SELECT, FROM in user inputs
Network Indicators:
- HTTP POST/GET requests to model.ajax.php with SQL keywords in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_server_logs" AND uri="/main/inc/ajax/model.ajax.php" AND (param="*UNION*" OR param="*SELECT*" OR param="*FROM*")🔗 References
- https://github.com/chamilo/chamilo-lms/commit/005dc8e9eccc6ea35264064ae09e2e84af8d5b59
- https://github.com/chamilo/chamilo-lms/commit/f7f93579ed64765c2667910b9c24d031b0a00571
- https://murat.one/?p=118
- https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-67-2021-05-27-High-impact-very-high-risk-Unauthenticated-SQL-injection
- https://github.com/chamilo/chamilo-lms/commit/005dc8e9eccc6ea35264064ae09e2e84af8d5b59
- https://github.com/chamilo/chamilo-lms/commit/f7f93579ed64765c2667910b9c24d031b0a00571
- https://murat.one/?p=118
- https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-67-2021-05-27-High-impact-very-high-risk-Unauthenticated-SQL-injection
