CVE-2025-50192
Time-Based SQL Injection in Chamilo Registration Webservice
Publication date: 2026-03-02
Last updated on: 2026-03-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chamilo | chamilo_lms | to 1.11.30 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-50192 is a time-based SQL Injection vulnerability in the Chamilo learning management system, specifically in the SOAP registration script located at /main/webservices/registration.soap.php. The vulnerability arises because the application directly interpolated user-supplied date parameters (startingDate and endingDate) into an SQL query without proper sanitization. This allowed an attacker to inject arbitrary SQL code, potentially altering the query logic. The issue was fixed by refactoring the code to use parameterized queries with bound parameters, which securely escape user inputs and prevent SQL injection.
How can this vulnerability impact me? :
This vulnerability can be exploited remotely by an attacker without any privileges or user interaction. It allows the attacker to modify the SQL query logic by injecting malicious SQL statements. The impact is high on the confidentiality and availability of the system, meaning sensitive data could be exposed or the system could be disrupted. However, the integrity of the data is not affected by this vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for unusual or delayed responses from the Chamilo LMS SOAP registration endpoint, specifically the /main/webservices/registration.soap.php script.'}, {'type': 'paragraph', 'content': 'An attacker may exploit the vulnerability by sending specially crafted SOAP POST requests with the parameters startingDate and endingDate containing SQL injection payloads, such as time delays (e.g., sleep(1)) to confirm exploitation.'}, {'type': 'paragraph', 'content': 'To detect exploitation attempts, you can capture and analyze HTTP POST requests to the registration.soap.php endpoint looking for suspicious payloads in these parameters.'}, {'type': 'list_item', 'content': 'Use network traffic capture tools like tcpdump or Wireshark to filter HTTP POST requests to /main/webservices/registration.soap.php.'}, {'type': 'list_item', 'content': "Example tcpdump command: tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'registration.soap.php'"}, {'type': 'list_item', 'content': "Use web server logs to search for POST requests to /main/webservices/registration.soap.php containing suspicious SQL keywords or time delay functions like 'sleep'."}, {'type': 'list_item', 'content': "Example grep command on Apache logs: grep 'POST /main/webservices/registration.soap.php' /var/log/apache2/access.log | grep -i 'sleep'"}] [2]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, you should upgrade Chamilo LMS to version 1.11.30 or later, where the issue has been patched.
The patch replaces vulnerable SQL query construction with parameterized queries that safely escape user inputs, preventing SQL injection.
Additional mitigation steps include:
- Implement parameterized SQL queries (prepared statements) instead of string concatenation in your code.
- Validate and whitelist allowed values for the startingDate and endingDate parameters.
- Restrict database user privileges to the minimum necessary to reduce impact if exploited.
- Monitor and block suspicious requests targeting the vulnerable endpoint.