Chamilo LMS EUVD-2026-116197

Requires an authenticated Chamilo LMS administrator account (PR:H confirmed by CVSS and explicitly stated in the GHSA advisory: 'Administrator credentials are required to exploit the issue'). The exact trigger is a request to /main/inc/ajax/model.ajax.php with a=get_sessions, _search=true, and a filters JSON object whose groupOp field contains SQL syntax instead of AND/OR; the endpoint and action are standard application functionality, so no non-default configuration is needed. The principal limiting factor is the administrator privilege requirement - there is no unauthenticated or low-privilege path in the available data; no special platform or version condition applies beyond running an affected release (<=2.0.0, i.e. prior to 1.11.40 on the 1.x branch or prior to 2.0.1 on the 2.x branch).

This is a real but gated issue, not an internet-facing emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2 High) is network-reachable with low complexity and no user interaction, but PR:H is the decisive limiter: the GHSA advisory and NVD both confirm that valid administrator credentials are required, so the attacker must already hold the highest application privilege. The vuln.today decision label is 'this_week' (priority, not act_now/emergency), which is consistent with a privileged post-authentication flaw. No EPSS score and no KEV listing are present in the input, so there is no signal of widespread or active exploitation - treat exploitation likelihood as unquantified rather than low. The GHSA advisory confirms the flaw was verified with a time-based blind payload (≈5s delay), but no working exploit code or SSVC decision tree (automatable/technical-impact fields) is supplied, so automatability cannot be assessed. Net: a legitimately High-severity SQL injection whose real-world risk is bounded by the administrator-credential prerequisite - prioritize patching this cycle rather than as an out-of-band emergency, and note that an admin who abuses it is largely escalating within privileges they already partly possess (though SQLi can still reach data and DB-level actions beyond the app's normal admin scope).

An attacker who has obtained or been granted Chamilo administrator credentials (e.g. a malicious insider, a compromised admin account, or a lower-trust admin exceeding intended scope) sends an authenticated AJAX request to /main/inc/ajax/model.ajax.php with a=get_sessions and _search=true, embedding SQL syntax in the groupOp field of the JSON filters parameter. Because groupOp is not validated against AND/OR before being used in query logic, the database executes the injected expression, enabling blind/time-based extraction of user, session, configuration, and password-reset data or record modification subject to DB privileges. The advisory confirms the flaw via a measurable ~5-second time delay, but no public working exploit code is provided in the input.