CVE-2025-52482
📋 TL;DR
A stored cross-site scripting (XSS) vulnerability in Chamilo LMS allows teachers to inject malicious JavaScript into the glossary function, which executes when administrators view the content. This enables teachers to perform actions as administrators, potentially compromising the entire learning management system. All Chamilo installations prior to version 1.11.30 with teacher users are affected.
💻 Affected Systems
- Chamilo LMS
📦 What is this software?
Chamilo Lms by Chamilo
⚠️ Risk & Real-World Impact
Worst Case
Teacher gains full administrative control, leading to data theft, system compromise, or complete platform takeover.
Likely Case
Teacher steals administrator session cookies, performs unauthorized actions, or defaces the platform.
If Mitigated
Limited to teacher-accessible functions with proper input validation and output encoding in place.
🎯 Exploit Status
Exploitation requires teacher credentials and knowledge of XSS payloads; trivial for attackers with basic web skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.11.30
Vendor Advisory: https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-4wcp-3rh3-7wm4
Restart Required: No
Instructions:
1. Backup your Chamilo installation and database. 2. Download version 1.11.30 from the official repository. 3. Replace affected files with patched versions. 4. Clear application cache if applicable.
🔧 Temporary Workarounds
Disable Glossary Function
allTemporarily disable the glossary feature to prevent exploitation.
# Modify Chamilo configuration to remove glossary access
Implement WAF Rules
linuxAdd web application firewall rules to block XSS payloads in glossary inputs.
# Example ModSecurity rule: SecRule ARGS "<script" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Restrict teacher access to glossary function through role-based permissions.
- Implement content security policy (CSP) headers to mitigate script execution.
🔍 How to Verify
Check if Vulnerable:
Check if Chamilo version is below 1.11.30 and verify teacher role has glossary access.Check Version:
Check Chamilo admin panel or database version table.Verify Fix Applied:
Confirm installation is version 1.11.30 or higher and test glossary input sanitization.📡 Detection & Monitoring
Log Indicators:
- Unusual glossary entries with script tags
- Multiple glossary modifications by teacher accounts
Network Indicators:
- HTTP requests containing script payloads to glossary endpoints
SIEM Query:
source="chamilo_logs" AND (glossary AND (script OR javascript OR alert))🔗 References
- https://github.com/chamilo/chamilo-lms/commit/241c569dde0ad0e34d558ae51271f70438189b0e
- https://github.com/chamilo/chamilo-lms/commit/82cc07edd8ef316e6b36da7c501120d5c0aeb151
- https://github.com/chamilo/chamilo-lms/commit/f9150075246df4ed9755a4a150e25edb468767be
- https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30
- https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-4wcp-3rh3-7wm4
