Chamilo Lms EUVD-2026-12500

Authenticated user account on Chamilo LMS version 1.11.34 or prior; access to statistics AJAX endpoint; vulnerable str_replace() escaping bypass in date_start and date_end parameter processing.

The CVSS score of 8.8 reflects high severity with network-based attack vector, low complexity, and low privilege requirements, indicating this is easily exploitable by any authenticated user. The impact ratings are all High for confidentiality, integrity, and availability. However, the requirement for authentication (PR:L) significantly reduces the attack surface compared to unauthenticated SQL injections. No EPSS score or KEV listing is currently available, suggesting this vulnerability has not been observed in active exploitation. The SSVC framework would classify this as a medium priority given the authentication requirement and lack of evidence for automated exploitation tools. While the technical impact is severe (full database compromise), the real-world risk is moderated by the authentication barrier and the specialized nature of LMS deployments.

An authenticated attacker with basic user privileges could craft malicious date parameters containing SQL injection payloads when accessing the statistics AJAX endpoint. By injecting time-based or boolean-based SQL queries, the attacker could systematically extract sensitive information including user credentials, grades, and personal data from the database. Given the low attack complexity and network-based vector, this could be executed remotely without any user interaction, making it particularly dangerous in multi-tenant educational environments where students or low-privileged staff have authenticated access.