CVE-2025-52564
Cross-Site Scripting in Chamilo help.php via Unsanitized Input
Publication date: 2026-03-02
Last updated on: 2026-03-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chamilo | chamilo_lms | to 1.11.30 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-80 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by checking if the Chamilo LMS instance is running a version prior to 1.11.30 and if the help.php file\'s "open" parameter is vulnerable to HTML injection.'}, {'type': 'paragraph', 'content': 'One way to detect exploitation attempts is to monitor web server logs for requests to help.php containing suspicious HTML tags such as <u> or other injected HTML in the "open" parameter.'}, {'type': 'paragraph', 'content': 'Example command to search web server logs for suspicious requests (assuming Apache logs):'}, {'type': 'list_item', 'content': "grep -i 'help.php' /var/log/apache2/access.log | grep -E '%3Cu|<u|%3C|%3E|%26'"}, {'type': 'paragraph', 'content': 'Alternatively, you can use curl or wget to test if the parameter is sanitized by sending a crafted URL with HTML tags and observing the response.'}, {'type': 'list_item', 'content': "curl -i 'http://your-chamilo-instance/main/help/help.php?open=%3Cu%3ETEST%3C%2Fu%3E'"}, {'type': 'paragraph', 'content': 'If the response contains the injected HTML tags rendered (e.g., underlined text), the system is vulnerable.'}] [2, 3]
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2025-52564 is a vulnerability in the Chamilo learning management system affecting versions up to 1.11.28. The issue is caused by improper sanitization of the "open" parameter in the help.php file, which allows an attacker to inject arbitrary HTML content via a crafted URL.'}, {'type': 'paragraph', 'content': 'Specifically, the parameter fails to neutralize special characters such as <, >, and &, enabling HTML injection that can render elements like underlined text (e.g., using <u>TEST<u>). This is classified as a CWE-80 vulnerability, indicating improper neutralization of script-related HTML tags, a form of cross-site scripting (XSS).'}, {'type': 'paragraph', 'content': 'The vulnerability was patched in version 1.11.30 by implementing input sanitization and a whitelist of allowed help topics.'}] [2, 3]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability allows an attacker to inject arbitrary HTML into the help.php page via the "open" parameter. This can lead to the display of malicious or misleading content, such as underlined text or other HTML elements, potentially deceiving users.'}, {'type': 'paragraph', 'content': 'While the vulnerability is a form of cross-site scripting (XSS), it is considered low severity. However, it could be exploited to perform UI redressing or phishing attacks within the affected Chamilo LMS instance.'}] [2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The immediate mitigation step is to upgrade Chamilo LMS to version 1.11.30 or later, where the vulnerability has been patched.'}, {'type': 'paragraph', 'content': 'If upgrading immediately is not possible, apply the patch that sanitizes the "open" parameter in help.php by implementing a whitelist of allowed help topics and using input sanitization functions such as Security::remove_XSS().'}, {'type': 'paragraph', 'content': 'Additionally, monitor and restrict access to the help.php page to trusted users or networks to reduce exposure.'}] [2, 3]