Read the docs
TI-2026-84485 Aliases CVE-2026-45146

Blind SQL injection in Chamilo LMS lets administrators extract data

Priority LOW 32CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Chamilo LMS before 1.11.40 and from 2.0.0 before 2.0.1 is affected. The groupOp filter value is not limited to AND or OR before it enters SQL queries, which is an improper neutralization of SQL syntax (CWE-89). An authenticated administrator can run blind or time-based SQL injection to read, modify or delete database records and cause denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the get_sessions action in /main/inc/ajax/model.ajax.php with _search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is not restricted to the expected AND or OR operators before it is incorporated into query logic, attacker-controlled input is interpreted by the database and enables blind or time-based SQL injection. Successful exploitation can disclose sensitive user, course, session, configuration, password-reset, and administrative data, modify or delete records subject to database privileges, and cause denial of service through expensive delayed queries. This issue is fixed in versions 1.11.40 and 2.0.1.

Why it matters now

EPSS 0.00317 24th percentileScored 2026-11-07
Fix Fixed chamilo-lms (chamilo): 1.11.40, 2.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
chamilochamilo-lmsbefore 1.11.40; 2.0.0 to before 2.0.11.11.40, 2.0.1Patch availableCNA
  • chamilo-lms Vendorchamilo Affected before 1.11.40; 2.0.0 to before 2.0.1 Fixed in 1.11.40, 2.0.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*——chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:* Versions — — ·chamilo

Remediation

Upgrade Chamilo LMS to version 1.11.40 for the 1.x line, or to version 2.0.1 for the 2.0.0 line.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA chamilo-lms (chamilo) Fixed in 1.11.40, 2.0.1

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-45146
  2. 2026-11-05 Priority changed: MEDIUM → LOW

References

Other 5

  • TI-2023-17452 A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to… CVSS 3.1CRITICAL 9.8
  • TI-2023-03150 Chamilo LMS Unauthenticated Command Injection CVSS 3.1CRITICAL 9.8
  • TI-2025-32070 Chamilo: Evaluation of untrusted user input leads to Remote Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2025-32081 Deserialization of untrusted data in chamilo-lms CVSS 4.0HIGH 8.8
  • TI-2024-32140 Chamilo: Post-Auth Remote Code Execution CVSS 4.0HIGH 8.7
  • TI-2023-03907 Chamilo LMS Unauthenticated Big Upload File Remote Code Execution CVSS 3.1HIGH 8.1
See all 162 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences