CyberRota Analysis
AI-GeneratedChamilo LMS versions prior to 1.11.42 and 3.0.0 are vulnerable to a stored cross-site scripting (XSS) flaw that allows unauthenticated attackers to inject malicious scripts into survey answers. This can lead to arbitrary script execution in the browsers of teachers or administrators, potentially enabling persistent backdoor account creation through the exploitation of authenticated sessions. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access and data compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint. Attackers can submit crafted answers containing unescaped HTML rendered in reporting views to execute arbitrary scripts in the browser sessions of teachers or administrators, enabling persistent backdoor account creation by exploiting the victim's authenticated session.