CVE-2025-50189
Published: 02 March 2026
Summary
CVE-2025-50189 is a high-severity SQL Injection (CWE-89) vulnerability in Chamilo Chamilo Lms. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates SQL injection by requiring validation and sanitization of user-supplied POST parameters like resource[document] and login before database query construction.
Ensures timely remediation of the specific SQL injection flaw in Chamilo by applying patches such as version 1.11.30.
Identifies SQL injection vulnerabilities like CVE-2025-50189 through automated scanning and monitoring, enabling remediation before exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a web-accessible LMS endpoint directly enables remote exploitation of a public-facing application (T1190) and unauthorized access/manipulation of database contents (T1213.006).
NVD Description
Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the POST resource[document][SQL_INJECTION_HERE] and POST login parameters found in /main/coursecopy/copy_course_session_selected.php, which allows an attacker to perform an attack…
more
aimed at modifying the database query logic by injecting an arbitrary SQL statements. This issue has been patched in version 1.11.30.
Deeper analysisAI
CVE-2025-50189 is a SQL injection vulnerability in Chamilo, an open-source learning management system. Prior to version 1.11.30, the application fails to sufficiently validate user-supplied data in POST parameters such as resource[document] and login within the /main/coursecopy/copy_course_session_selected.php endpoint. This flaw, classified under CWE-89, enables attackers to inject arbitrary SQL statements that alter database query logic. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for confidentially, integrity, and availability impacts.
An authenticated attacker with low privileges, such as a registered user, can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By crafting malicious POST requests to the affected endpoint, the attacker can manipulate SQL queries to achieve outcomes like data exfiltration, modification, or deletion, depending on database permissions and structure.
The issue has been addressed in Chamilo version 1.11.30, as detailed in the project's GitHub security advisory (GHSA-vxx3-648j-7p4r) and release notes. Mitigation involves upgrading to the patched version, with relevant fixes implemented in commits such as 22bb81df8f7062da20a2f6248789f47b221ca705, 75ab03c938adc48a3cd8234d98fc340e1998aa81, and 7903cef2eb41817c11a52ba6ac34a1d454bc5ef7. Security practitioners should review access controls on the course copy functionality and apply input sanitization as interim measures if immediate patching is not feasible.
Details
- CWE(s)