CVE-2026-30881: Chamilo LMS: SQL Injection in the statistics AJAX endpoint
Chamilo LMS is a learning management system. Version 1.11.34 and prior contains a SQL Injection vulnerability in the statistics AJAX endpoint. The parameters datestart and dateend from $REQUEST are embedded directly into a raw SQL string without proper sanitization. Although Database::escapestring() is called downstream, its output is immediately neutralized by strreplace("\'", "'", ...), which restores any injected single quotes — effectively bypassing the escaping mechanism entirely. This allows an authenticated attacker to inject arbitrary SQL statements into the database query, enabling blind time-based and conditional data extraction. This issue has been patched in version 1.11.36.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30881?
CVE-2026-30881 is classified as a high severity SQL Injection vulnerability.
How do I fix CVE-2026-30881?
To fix CVE-2026-30881, upgrade Chamilo LMS to version 1.11.36 or later, which addresses this vulnerability.
What products are affected by CVE-2026-30881?
CVE-2026-30881 affects Chamilo LMS versions 1.11.34 and prior.
What type of vulnerability is CVE-2026-30881?
CVE-2026-30881 is an SQL Injection vulnerability found in the statistics AJAX endpoint.
Can CVE-2026-30881 lead to data exposure?
Yes, due to SQL Injection, CVE-2026-30881 could allow an attacker to manipulate database queries, potentially exposing sensitive information.