CVE-2026-28430: Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php
Chamilo LMS is a learning management system. Prior to version 1.11.34, there is an unauthenticated SQL injection vulnerability which allows remote attackers to execute arbitrary SQL commands via the customdates parameter. By chaining this with a predictable legacy password reset mechanism, an attacker can achieve full administrative account takeover without any prior credentials. The vulnerability also exposes the entire database, including PII and system configurations. This issue has been patched in version 1.11.34.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28430?
CVE-2026-28430 is classified as a high severity vulnerability due to its potential for unauthenticated SQL injection allowing remote code execution.
How do I fix CVE-2026-28430?
The recommended fix for CVE-2026-28430 is to upgrade Chamilo LMS to version 1.11.34 or later.
What exploitation methods exist for CVE-2026-28430?
Exploitation of CVE-2026-28430 can be achieved through sending specially crafted requests to the chamilo-lms model.ajax.php script.
What impacts can CVE-2026-28430 have on my system?
CVE-2026-28430 can allow an attacker to execute arbitrary SQL commands, potentially compromising sensitive data within the database.
Is CVE-2026-28430 present in the latest Chamilo LMS version?
No, CVE-2026-28430 is not present in Chamilo LMS version 1.11.34 or later.