Which versions of PHP are affected by CVE-2026-33714?

Chamilo LMS 2.0.0-RC.2 contains a SQL injection vulnerability in the statistics module that allows authenticated administrators to extract sensitive database contents through unsanitized date…. A patch is available.

How to fix or mitigate CVE-2026-33714?

Within 24 hours: inventory all Chamilo LMS instances and identify those running version 2.0.0-RC.2 or earlier. Within 7 days: upgrade to the patched release (version 2.0.0 or later per vendor advisory) and verify the fix by reviewing sanitization of date parameters in the statistics AJAX endpoint. Within 30 days: audit administrator account activity logs for the past 90 days to detect potential exploitation, and implement principle-of-least-privilege controls to restrict statistics module access to necessary admin roles only.

PHP CVE-2026-33714

Q: What is the CVSS score of CVE-2026-33714?

CVE-2026-33714 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-22708 HIGH

SQL Injection (CWE-89)

2026-04-14 GitHub_M

SQLi PHP

7.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 23, 2026 - 14:55 nvd

Patch available

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:57 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.0.0

Analysis Generated

Apr 14, 2026 - 22:39 vuln.today

CVSS changed

Apr 14, 2026 - 21:22 NVD

7.1 (HIGH)

EUVD ID Assigned

Apr 14, 2026 - 21:16 euvd

EUVD-2026-22708

Analysis Generated

Apr 14, 2026 - 21:16 vuln.today

CVE Published

Apr 14, 2026 - 21:00 nvd

HIGH 7.1

DescriptionGitHub Advisory

Chamilo is an open-source learning management system (LMS). Version 2.0.0-RC.2 contains a SQL Injection vulnerability in the statistics AJAX endpoint, which is an incomplete fix for CVE-2026-30881. While CVE-2026-30881 was patched by applying Security::remove_XSS() to the date_start and date_end parameters in the get_user_registration_by_month action, the same parameters remain unsanitized in the users_active action within the same file (public/main/inc/ajax/statistics.ajax.php), where they are directly interpolated into a SQL query. An authenticated admin can exploit this to perform time-based blind SQL injection, enabling extraction of arbitrary data from the database. This issue has been fixed in version 2.0.0.

AnalysisAI

SQL injection in Chamilo LMS 2.0.0-RC.2 allows authenticated administrators to extract arbitrary database contents via unsanitized date parameters in the statistics AJAX endpoint's users_active action. This represents an incomplete fix for CVE-2026-30881, where only one of two vulnerable parameter sets was sanitized. Time-based blind SQL injection techniques enable data exfiltration despite requiring admin-level authentication. EPSS data not available; no public exploit identified at time of analysis, though the incomplete remediation pattern and technical details in the GitHub advisory lower exploitation barriers for attackers with admin access.

Technical ContextAI

Chamilo LMS is a PHP-based open-source learning management system. This vulnerability stems from CWE-89 (SQL Injection) in the statistics AJAX endpoint (public/main/inc/ajax/statistics.ajax.php). When CVE-2026-30881 was patched, developers applied the Security::remove_XSS() sanitization function to date_start and date_end parameters in the get_user_registration_by_month action, but failed to apply the same fix to identical parameters in the users_active action within the same file. These parameters are directly interpolated into SQL queries without parameterization or escaping, creating a classic first-order SQL injection point. The CVSS vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation with low complexity, though requiring authenticated low-privilege access (admin role in this case). The vulnerability enables time-based blind SQL injection, a technique where attackers infer database contents by measuring server response times to conditional queries, allowing byte-by-byte data extraction even without direct error messages or query results.

RemediationAI

Upgrade immediately to Chamilo LMS version 2.0.0, which contains the complete fix addressing both the original CVE-2026-30881 and this incomplete-fix bypass (release details at https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0). The patch applies proper input sanitization to date_start and date_end parameters in the users_active action, matching the protections already implemented for get_user_registration_by_month. If immediate upgrade is not feasible, implement temporary compensating controls: restrict admin account access through IP allowlisting, enforce multi-factor authentication for all administrative users, monitor SQL query logs for anomalous timing patterns or unexpected date parameter values in statistics.ajax.php requests, and consider disabling the statistics AJAX endpoint entirely if not operationally required. No effective workaround exists beyond access restriction, as the vulnerability is in core application logic. Review all admin accounts for compromise indicators prior to patching, as attackers with prior admin access could have already exploited this during the window between CVE-2026-30881's fix and this complete remediation.