CVE-2026-45146
Received Received - Intake

Blind SQL Injection in Chamilo LMS

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: GitHub, Inc.

Description
Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the get_sessions action in /main/inc/ajax/model.ajax.php with _search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is not restricted to the expected AND or OR operators before it is incorporated into query logic, attacker-controlled input is interpreted by the database and enables blind or time-based SQL injection. Successful exploitation can disclose sensitive user, course, session, configuration, password-reset, and administrative data, modify or delete records subject to database privileges, and cause denial of service through expensive delayed queries. This issue is fixed in versions 1.11.40 and 2.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-45146
EUVD
EUVD-2026-116197

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
chamilo chamilo-lms < 1.11.40
chamilo chamilo-lms >= 2.0.0, < 2.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a blind SQL injection vulnerability in Chamilo LMS versions before 1.11.40 and 2.0.1. An authenticated administrator can exploit it by sending a crafted JSON request with _search=true and a malicious filters[groupOp] parameter containing SQL syntax. The application fails to validate this input, allowing arbitrary SQL commands to execute in the database.

Detection Guidance

To detect this vulnerability, check if your Chamilo LMS version is below 1.11.40 or 2.0.1. Test for blind SQL injection by sending a request with _search=true and a crafted groupOp parameter to /main/inc/ajax/model.ajax.php. Look for time delays of approximately 5 seconds in responses, which indicate successful exploitation.

Impact Analysis

An attacker with admin access could extract sensitive data like user credentials, course information, session details, or configuration settings. They may also modify or delete records, cause denial of service through expensive queries, or escalate privileges depending on database permissions.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Immediately upgrade Chamilo LMS to version 1.11.40 or 2.0.1 or later. Ensure no unauthorized access has occurred by reviewing logs for suspicious AJAX requests to /main/inc/ajax/model.ajax.php with _search=true and modified groupOp parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45146. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...