Description

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint. Attackers can submit crafted answers containing unescaped HTML rendered in reporting views to execute arbitrary scripts in the browser sessions of teachers or administrators, enabling persistent backdoor account creation by exploiting the victim's authenticated session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-11T18:16:59.290Z",
  "pubdate": "2026-09-11T18:16:59.290Z",
  "executiveSummary": "Chamilo LMS versions prior to 1.11.42 and 3.0.0 are susceptible to a stored Cross-Site Scripting (XSS) vulnerability residing within the survey submission module. This flaw permits unauthenticated remote attackers to inject malicious HTML and JavaScript payloads into survey responses by exploiting predictable invitation codes and insufficient authorization checks within the submission endpoint. The vulnerability poses a critical risk to organizational integrity, as it allows for the execution of arbitrary scripts within the browser sessions of high-privileged users, such as teachers or administrators. Successful exploitation facilitates persistent unauthorized access, including the surreptitious creation of backdoor accounts. The vulnerability is characterized by its ability to bypass standard authentication mechanisms, granting attackers a broad surface for post-exploitation activities within the LMS environment. Given that the payloads are rendered in administrative reporting views, the risk of session hijacking and unauthorized administrative control is significant.",
  "technicalDetails": "The vulnerability originates from a failure to perform adequate authorization verification and input sanitization within the Chamilo LMS survey submission mechanism. Specifically, the system utilizes deterministic invitation codes for surveys that do not require valid authentication for submission, allowing an attacker to derive or brute-force these codes to bypass intended access restrictions.\nThe attack flow commences with the identification of a target survey's invitation code. By manipulating the deterministic nature of these codes, an unauthenticated attacker can interact with the survey submission endpoint. The vulnerability exists because the endpoint accepts survey answers without implementing server-side sanitization or output encoding for user-supplied data that is subsequently stored in the application database.\nDuring the exploitation phase, an attacker crafts a malicious payload containing HTML tags and JavaScript. This payload is submitted as a survey answer. Because the application stores this data in its backend and later retrieves and displays it within administrative reporting interfaces without proper escaping, the payload is executed in the context of the administrator’s or teacher's browser session.\nWhen a privileged user accesses the reporting view, the application serves the unescaped script, which executes within the victim's session. This allows the attacker to leverage the victim's authenticated state to perform unauthorized actions on their behalf. Given the application's context, the primary impact involves the automated creation of administrative backdoor accounts, effectively achieving persistent, unauthorized access to the LMS platform. The flaw highlights a critical deficiency in input handling and access control orchestration within the survey module, where user-supplied content is treated as trusted data and rendered directly in privileged viewing contexts."
}