CVE-2025-52470

Stored XSS

Persistent Cross-Site Scripting vulnerability in Chamilo LMS ≤ 1.11.28

Overview

A stored cross-site scripting (XSS) vulnerability was discovered in Chamilo LMS versions up to 1.11.28. The issue allows an authenticated admin user to inject JavaScript via the "Session Category" feature, which gets executed in the context of other administrative users.

Affected Versions

Technical Details

The vulnerability is found in the file session_category_add.php, where user-supplied input for the Category Name is not properly sanitized before being stored in the database.

This input is rendered unescaped in add_many_sessions_to_category.php, leading to persistent XSS execution when the page is visited by any other admin user.

Steps to reproduce:

1. Login as an admin user.
2. Go to session_category_add.php.
3. Enter the following payload in the Category Name field:
   <img/src/onerror=alert(2)>
4. Submit the form.
5. Navigate to add_many_sessions_to_category.php.
6. The alert will trigger, demonstrating successful XSS.

Impact

This stored XSS vulnerability allows a privileged attacker to:

Solution

Timeline

References