HTB23182: Chamilo LMS SQL injection SQLi

Chamilo LMS version 1.9.6 is vulnerable to perform SQL injection attacks, discovered by High-Tech Bridge Security Research Lab.

Chamilo LMS - Chamilo aims at bringing you the best e-learning and collaboration platform in the open source world.

SQL Injection vulnerability in Chamilo LMS exists due to insufficient validation of "password0" HTTP POST parameter passed to "/main/auth/profile.php" script. A remote authenticated attacker can execute arbitrary SQL commands in application's database. Exploitation example in advisory HTB23182 - SQL Injection in Chamilo LMS displays version of MySQL server. Successful exploitation of this vulnerability requires that the application is configured during installation not to encrypt users' passwords ("Encryption method" option is set to "none").

Solution: Edit the source code and apply changes according to vendor's instructions.