Live › vulnerability › CVE-2026-45146
Chamilo LMS, an open-source learning management system, fails to restrict the groupOp field of the get_sessions AJAX search filter to AND or OR, so its SQL is built from attacker text. An authenticated administrator can use blind or time-based SQL injection to read user, course and password-reset data, change or delete records, or slow the database down.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 20:49 UTC. All times on this page are UTC.
Only installs of Chamilo LMS before 1.11.40 and before 2.0.1 are exposed, and only an administrator account can reach the flaw, so an attacker needs admin access first. Teams running Chamilo for course delivery on their own servers should check their version; hosted or managed Chamilo instances are the vendor's to patch.
No product ranges from the sources yet.
1.11.40 and 2.0.1 as the fixed releases.main/inc/ajax/model.ajax.php file exposes the get_sessions action on your install.1.11.40.2.0.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the get_sessions action in /main/inc/ajax/model.ajax.php with _search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is not restricted to the expected AND or OR operators before it is incorporated into query logic, attacker-controlled input is interpreted by the database and enables blind or time-based SQL injection. Successful exploitation can disclose sensitive user, course, session, configuration, password-reset, and administrative data, modify or delete records subject to database privileges, and cause denial of service through expensive delayed queries. This issue is fixed in versions 1.11.40 and 2.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-45146")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.