CVE-2025-52470: Chamilo: Stored Cross-Site Scripting (XSS) via Session Category Name
Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting (XSS) vulnerability exists in the sessioncategoryadd.php script. The vulnerability is caused by improper sanitization of the Category Name field, allowing privileged users to inject persistent JavaScript payloads. The injected script is later executed when accessing addmanysessionstocategory.php, potentially compromising administrative sessions. This issue has been patched in version 1.11.30.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52470?
CVE-2025-52470 has a medium severity rating due to its potential for exploitation through stored cross-site scripting.
How do I fix CVE-2025-52470?
To fix CVE-2025-52470, upgrade Chamilo to version 1.11.30 or later to ensure proper input sanitization.
What type of vulnerability is CVE-2025-52470?
CVE-2025-52470 is a stored cross-site scripting (XSS) vulnerability affecting the session_category_add.php script.
Which versions of Chamilo are affected by CVE-2025-52470?
Versions of Chamilo prior to 1.11.30 are affected by CVE-2025-52470.
What is the impact of exploiting CVE-2025-52470?
Exploiting CVE-2025-52470 can allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser.