{"id":"CVE-2026-45146","kind":"vulnerability","aliases":["CVE-2026-45146"],"related":[],"title":"Chamilo LMS: admin search parameter lets SQL injection read and change data","description":"Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the get_sessions action in /main/inc/ajax/model.ajax.php with _search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is not restricted to the expected AND or OR operators before it is incorporated into query logic, attacker-controlled input is interpreted by the database and enables blind or time-based SQL injection. Successful exploitation can disclose sensitive user, course, session, configuration, password-reset, and administrative data, modify or delete records subject to database privileges, and cause denial of service through expensive delayed queries. This issue is fixed in versions 1.11.40 and 2.0.1.","summary":"Chamilo LMS, an open-source learning management system, fails to restrict the groupOp field of the get_sessions AJAX search filter to AND or OR, so its SQL is built from attacker text. An authenticated administrator can use blind or time-based SQL injection to read user, course and password-reset data, change or delete records, or slow the database down.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chamilo-lms","mysql","package","php","self-hosted"],"not_affected_if":["managed-hosting","patched-version"],"how_to_check":"- Check the installed Chamilo version; the sources list `1.11.40` and `2.0.1` as the fixed releases.\n- Confirm whether the `main/inc/ajax/model.ajax.php` file exposes the `get_sessions` action on your install.","fix":"- Move Chamilo LMS 1.11.x installs to `1.11.40`.\n- Move Chamilo LMS 2.0.x installs to `2.0.1`.","status":"open","published_at":"2026-11-03T20:18:13+00:00","first_seen_at":"2026-11-03T20:49:22+00:00","triaged_at":"2026-11-03T20:50:18+00:00","updated_at":"2026-11-03T20:50:18+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T20:50:18Z","model":"claude-haiku-5-5","output":{"fix":"- Move Chamilo LMS 1.11.x installs to `1.11.40`.\n- Move Chamilo LMS 2.0.x installs to `2.0.1`.","reach":"network","title":"Chamilo LMS: admin search parameter lets SQL injection read and change data","impact":"high","summary":"Chamilo LMS, an open-source learning management system, fails to restrict the groupOp field of the get_sessions AJAX search filter to AND or OR, so its SQL is built from attacker text. An authenticated administrator can use blind or time-based SQL injection to read user, course and password-reset data, change or delete records, or slow the database down.","audience":"businesses","category":"package","nicknames":[],"who_cares":["chamilo-lms","self-hosted","php","mysql"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads or alters the entire LMS database, including credentials.","analyst_note":"","how_to_check":"- Check the installed Chamilo version; the sources list `1.11.40` and `2.0.1` as the fixed releases.\n- Confirm whether the `main/inc/ajax/model.ajax.php` file exposes the `get_sessions` action on your install.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","patched-version"],"who_is_affected":"Only installs of Chamilo LMS before 1.11.40 and before 2.0.1 are exposed, and only an administrator account can reach the flaw, so an attacker needs admin access first. Teams running Chamilo for course delivery on their own servers should check their version; hosted or managed Chamilo instances are the vendor's to patch.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000743,"input_tokens":4336,"output_tokens":619,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-45146':15A,18A '/main/inc/ajax/model.ajax.php':116C '1.11.40':103C,207C '2.0.1':105C,209C 'action':114C 'admin':3A 'administr':64B,108C,182C 'ajax':47B 'attack':60B,152C 'attacker-control':151C 'authent':63B,107C 'base':71B,166C 'blind':67B,162C 'built':58B 'call':110C 'caus':193C 'chamilo':1A,20B,28B,91C 'chamilo-lm':19B 'chang':11A,83B 'configur':177C 'contain':129C 'control':153C 'cours':77B,175C 'craft':122C 'cve':13A,16A 'data':12A,82B,183C 'databas':90B,159C,190C 'delay':199C 'delet':85B,186C 'denial':194C 'disclos':172C 'enabl':161C 'expect':139C 'expens':198C 'exploit':170C 'fail':37B 'field':42B,128C 'filter':49B,124C 'fix':204C 'get':45B,112C 'groupop':41B,127C,133C 'host':27B 'incorpor':147C 'inject':8A,73B,168C 'input':154C 'interpret':156C 'issu':202C 'json':123C 'learn':34B,98C 'let':6A 'lms':2A,21B,29B,92C 'logic':150C 'manag':35B,99C 'modifi':184C 'mysql':22B 'open':32B,96C 'open-sourc':31B,95C 'oper':143C 'packag':23B 'paramet':5A,125C 'password':80B,179C 'password-reset':79B,178C 'php':24B 'prior':101C 'privileg':191C 'queri':149C,200C 'read':9A,75B 'record':86B,187C 'reset':81B,180C 'restrict':39B,136C 'search':4A,48B,118C 'self':26B 'self-host':25B 'sensit':173C 'servic':196C 'session':46B,113C,176C 'slow':88B 'sourc':33B,97C 'sql':7A,56B,72B,130C,167C 'subject':188C 'success':169C 'syntax':131C 'system':36B,100C 'text':61B 'time':70B,165C 'time-bas':69B,164C 'true':119C 'use':66B 'user':76B,174C 'version':206C 'whose':126C","nicknames":[],"mitigations":[],"who_affected":"Only installs of Chamilo LMS before 1.11.40 and before 2.0.1 are exposed, and only an administrator account can reach the flaw, so an attacker needs admin access first. Teams running Chamilo for course delivery on their own servers should check their version; hosted or managed Chamilo instances are the vendor's to patch.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["chamilolms","high","mysql","package","php","selfhosted"],"campaign_type":null,"first_public_at":"2026-07-01T09:59:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-45146","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45146","severity":null,"published_at":"2026-11-03T20:18:13+00:00","modified_at":"2026-11-03T20:18:13+00:00","first_seen_at":"2026-11-03T20:49:22+00:00","fetched_at":"2026-11-03T20:49:22+00:00","note":null}],"documents":[{"id":60567,"url":"https://github.com/chamilo/chamilo-lms/commit/4472f3089bbbca1b4713bfd7059907676b80d07f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60568,"url":"https://github.com/chamilo/chamilo-lms/commit/7cc961d60ac27eaccd6bcc8db201de2c65adfdf3","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":49708,"url":"https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.40","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":49709,"url":"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60571,"url":"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-prqp-8x29-cr88","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-01T09:59:08+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}