CVE-2025-50193
OS Command Injection in Chamilo import.php Before
Publication date: 2026-03-02
Last updated on: 2026-03-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chamilo | chamilo_lms | to 1.11.30 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Chamilo LMS to version 1.11.30 or later, where this vulnerability has been patched.
If upgrading immediately is not possible, restrict access to the vulnerable endpoint and ensure that only trusted administrators have access.
Implement strict input validation and whitelisting on the to_main_database parameter to prevent command injection.
Conduct thorough source code review to identify and fix improper handling of user input, especially in the /plugin/vchamilo/views/import.php file.
Monitor network traffic for unusual outbound connections that may indicate exploitation attempts.
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2025-50193 is a high-severity OS command injection vulnerability in the Chamilo learning management system versions up to 1.11.28. It exists in the /plugin/vchamilo/views/import.php file, specifically in the handling of the POST parameter to_main_database.'}, {'type': 'paragraph', 'content': "The vulnerability occurs because user-supplied input is passed directly to the operating system shell without proper sanitization. This allows an authenticated administrator to execute arbitrary system commands on the server under the application's process context."}, {'type': 'paragraph', 'content': 'Technically, the input flows into functions that construct and execute shell commands without proper validation or escaping, enabling command injection. Exploitation requires the VChamilo plugin to be enabled and administrator privileges.'}] [1]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability allows an attacker with administrator privileges to remotely execute arbitrary operating system commands on the server hosting Chamilo LMS.'}, {'type': 'paragraph', 'content': "The impact includes potential full system compromise, as the attacker can run commands under the application's process context, which may lead to unauthorized access, data manipulation, or disruption of service."}, {'type': 'paragraph', 'content': 'The CVSS score indicates a high severity with low confidentiality impact but high integrity and availability impact, meaning the attacker can alter or disrupt system operations significantly.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for suspicious POST requests to the endpoint /plugin/vchamilo/views/import.php, specifically looking at the to_main_database parameter for unusual input patterns such as command substitution syntax (e.g., backticks or $() constructs).'}, {'type': 'paragraph', 'content': 'Additionally, network detection can involve setting up listeners to detect reverse shell connections, such as using netcat to listen on suspicious ports that might be used by an attacker.'}, {'type': 'list_item', 'content': 'Check web server logs for POST requests to /plugin/vchamilo/views/import.php with suspicious payloads in the to_main_database parameter.'}, {'type': 'list_item', 'content': "Use a command like: grep 'to_main_database' /var/log/apache2/access.log or equivalent to find suspicious inputs."}, {'type': 'list_item', 'content': 'Set up a listener to detect reverse shell connections, e.g., nc -lvnp 1337.'}] [1]