Chamilo Learning Management System RCE

Chamilo LMS prior to 1.11.30 has an error-based SQL injection enabling database extraction.

Chamilo LMS prior to 1.11.28 has a code injection through SOAP request parameters enabling remote code execution.

Chamilo LMS prior to 1.11.30 has a time-based SQL injection in a different endpoint, providing an additional database extraction vector.

Chamilo is a learning management system. Chamillo is affected by a post-authentication phar unserialize which leads to a remote code execution (RCE) within versions 1.11.12 to 1.11.26. [CVSS 7.2 HIGH]