Chamilo EUVD-2026-22708

Requires authenticated admin access to Chamilo LMS version 2.0.0-RC.2. Attacker must access the statistics AJAX endpoint (public/main/inc/ajax/statistics.ajax.php) users_active action and inject SQL via unsanitized date_start or date_end parameters. No victim interaction needed.

Real-world risk is elevated but contextually constrained. The CVSS 7.1 score reflects high integrity impact (VI:H) and low confidentiality impact (VC:L), appropriate for SQL injection with data extraction capabilities. The PR:L (low privileges required) metric is somewhat misleading-while technically 'low privilege' in CVSS terms, this requires administrative access to Chamilo, a significant access barrier in most deployments. The AC:L (low attack complexity) accurately reflects that exploitation requires only crafted requests to a known endpoint with predictable parameters. From an SSVC perspective, this is not automatable at scale (requires pre-existing admin credentials), has high technical impact (database compromise), but exploitation status shows no active exploitation confirmed. The incomplete-fix nature is concerning-it demonstrates a patch gap pattern that sophisticated attackers specifically hunt for, and the GitHub security advisory provides sufficient technical detail to enable proof-of-concept development. Organizations should prioritize this if Chamilo admin accounts have been compromised previously, are shared across teams, or use weak authentication. The time-based blind SQL injection technique is slower than error-based or union-based injection but remains fully viable for patient attackers. For internet-facing Chamilo instances with valuable student/course data, this merits urgent attention despite the admin-access prerequisite.

An attacker who has compromised a Chamilo administrator account (through phishing, credential stuffing, or session hijacking) accesses the vulnerable statistics AJAX endpoint. They craft malicious HTTP requests to the users_active action, injecting time-based SQL payloads into the date_start or date_end parameters, such as appending "'; WAITFOR DELAY '00:00:05'--" for SQL Server or "' AND SLEEP(5)--" for MySQL. By measuring response delays, the attacker systematically extracts sensitive database contents including user credentials, personal information, course materials, and assessment data. The time-based technique allows complete database enumeration despite no direct query output, with each character of data requiring multiple timed requests to determine through binary search.