CVE-2018-20329

Chamilo LMS version 1.11.8 contains a main/inc/lib/CoursesAndSessionsCatalog.class.php SQL injection, allowing users with access to the sessions catalogue which may optionally be made public to extract and/or modify database information...

PT-2018-15312

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.8 Description The issue concerns a SQL injection in the main/inc/lib/CoursesAndSessionsCatalog.class.php file. This allows users with access to the sessions catalogue, which can be made public, to extract and/or modify...

CVE-2018-20328: Improper Neutralization of Input During Web Page Generation

Chamilo LMS version 1.11.8 contains XSS in main/social/groupview.php in the social groups tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of the feature it exploits...

CVE-2018-20327: Improper Neutralization of Input During Web Page Generation

Chamilo LMS version 1.11.8 contains XSS in main/template/default/admin/gradebooklist.tpl in the gradebook dependencies tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of t...

CVE-2018-20329: Improper Neutralization of Special Elements used in an SQL Command

Chamilo LMS version 1.11.8 contains a main/inc/lib/CoursesAndSessionsCatalog.class.php SQL injection, allowing users with access to the sessions catalogue which may optionally be made public to extract and/or modify database information...

PT-2018-15310

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.8 Description The issue affects the gradebook dependencies tool in the main/template/default/admin/gradebook list.tpl file, allowing authenticated users to impact other users under specific permission conditions grante...

PT-2018-15311

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.8 Description The issue allows authenticated users to affect other users under specific conditions of permissions granted by administrators. It is considered low risk due to the nature of the feature it exploits. The...

Chamilo 1.11.6 SQL Injection

SQL Injection Vulnerabilities in Chamilo 1.11.6 Information -------------------- Advisory by Netsparker Name: SQL Injection Vulnerabilities in Chamilo 1.11.6 Affected Software: Chamilo Affected Versions: 1.11.6 Homepage: https://chamilo.org/en/ Vulnerability: SQL injection Severity: High Status:...

Chamilo 1.11.6 Cross Site Scripting

Multiple Cross-site Scripting Vulnerabilities in Chamilo 1.11.6 Information -------------------- Advisory by Netsparker Name: Multiple Cross-site Scripting Vulnerabilities in Chamilo 1.11.6 Affected Software: Chamilo Affected Versions: 1.11.6 Homepage: https://chamilo.org/en/ Vulnerability:...

Chamilo LMS 1.11.8 firstname Cross Site Scripting

Exploit Title: Chamilo LMS 1.11.8 - 'firstname' Cross-Site Scripting Author: Cakes Discovery Date: 2018-10-06 Vendor Homepage: https://chamilo.org Software Link: https://github.com/chamilo/chamilo-lms/releases/download/v1.11.8/chamilo-1.11.8-php5.zip Tested Version: 1.11.8 for php5 Tested on OS:...

Chamilo LMS 1.11.8 - firstname Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Chamilo LMS 1.11.8 - 'firstname' Cross-Site Scripting Author: Cakes Vendor Homepage: https://chamilo.org Software Link: https://github.com/chamilo/chamilo-lms/releases/download/v1.11.8/chamilo-1.11.8-php5.zip Tested Version:...

Chamilo LMS 1.11.8 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Chamilo LMS 1.11.8 - Cross-Site Scripting Author: Cakes Vendor Homepage: https://chamilo.org Software Link: https://github.com/chamilo/chamilo-lms/releases/download/v1.11.8/chamilo-1.11.8-php5.zip Tested Version: 1.11.8 for php5...

Chamilo LMS 1.11.8 - 'firstname' Cross-Site Scripting

Exploit Title: Chamilo LMS 1.11.8 - 'firstname' Cross-Site Scripting Author: Cakes Discovery Date: 2018-10-06 Vendor Homepage: https://chamilo.org Software Link: https://github.com/chamilo/chamilo-lms/releases/download/v1.11.8/chamilo-1.11.8-php5.zip Tested Version: 1.11.8 for php5 Tested on OS:...

Chamilo LMS 1.11.8 - firstname Cross-Site Scripting

Chamilo LMS 1.11.8 - firstname Cross-Site Scripting Exploit Title: Chamilo LMS 1.11.8 - 'firstname' Cross-Site Scripting Author: Cakes Discovery Date: 2018-10-06 Vendor Homepage: https://chamilo.org Software Link:...

Chamilo LMS 1.11.8 Cross Site Scripting

Exploit Title: Chamilo LMS 1.11.8 - Cross-Site Scripting Author: Cakes Discovery Date: 2018-10-05 Vendor Homepage: https://chamilo.org Software Link: https://github.com/chamilo/chamilo-lms/releases/download/v1.11.8/chamilo-1.11.8-php5.zip Tested Version: 1.11.8 for php5 Tested on OS: Kali Linux...

Chamilo LMS 1.11.8 - Cross-Site Scripting

Chamilo LMS 1.11.8 - Cross-Site Scripting Exploit Title: Chamilo LMS 1.11.8 - Cross-Site Scripting Author: Cakes Discovery Date: 2018-10-05 Vendor Homepage: https://chamilo.org Software Link: https://github.com/chamilo/chamilo-lms/releases/download/v1.11.8/chamilo-1.11.8-php5.zip Tested Version:...

Chamilo LMS 1.11.8 - Cross-Site Scripting

Exploit Title: Chamilo LMS 1.11.8 - Cross-Site Scripting Author: Cakes Discovery Date: 2018-10-05 Vendor Homepage: https://chamilo.org Software Link: https://github.com/chamilo/chamilo-lms/releases/download/v1.11.8/chamilo-1.11.8-php5.zip Tested Version: 1.11.8 for php5 Tested on OS: Kali Linux...

CVE-2018-1999019

Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can result in Unauthenticated remote code execution. This attack appear to be exploitable via a simple GET request to the api endpoint. This...

Remote code execution

Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can result in Unauthenticated remote code execution. This attack appear to be exploitable via a simple GET request to the api endpoint. This...

CVE-2018-1999019

Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can result in Unauthenticated remote code execution. This attack appear to be exploitable via a simple GET request to the api endpoint. This...