CVE-2026-33714: Chamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2)
Chamilo is an open-source learning management system (LMS). Version 2.0.0-RC.2 contains a SQL Injection vulnerability in the statistics AJAX endpoint, which is an incomplete fix for CVE-2026-30881. While CVE-2026-30881 was patched by applying Security::removeXSS() to the datestart and dateend parameters in the getuserregistrationbymonth action, the same parameters remain unsanitized in the usersactive action within the same file (public/main/inc/ajax/statistics.ajax.php), where they are directly interpolated into a SQL query. An authenticated admin can exploit this to perform time-based blind SQL injection, enabling extraction of arbitrary data from the database. This issue has been fixed in version 2.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Chamilo LMSto a version that resolves this vulnerability.Fixed in 2.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33714?
CVE-2026-33714 has a high severity rating due to its potential for unauthorized data access through SQL Injection.
How do I fix CVE-2026-33714?
To fix CVE-2026-33714, upgrade Chamilo LMS to a version that addresses the SQL Injection vulnerability, avoiding version 2.0.0-RC.2.
Which version of Chamilo LMS is affected by CVE-2026-33714?
CVE-2026-33714 affects Chamilo LMS version 2.0.0-RC.2 specifically.
What type of vulnerability is CVE-2026-33714?
CVE-2026-33714 is an Authenticated SQL Injection vulnerability located in the statistics AJAX endpoint.
How does CVE-2026-33714 exploit user input?
CVE-2026-33714 exploits user input through insufficient validation in the statistics.ajax.php file, allowing attackers to execute arbitrary SQL queries.