CVE-2024-47886
Plain English Summary
AI-powered analysis for quick understanding
This vulnerability allows an attacker with administrative access to the Chamilo learning management system to run any code they want on the server, potentially taking full control of it. It affects versions 1.11.12 to 1.11.26, and has been fixed in the latest version, so it's crucial to update to protect against this risk.
Technical Description
Chamilo is a learning management system. Chamillo is affected by a post-authentication phar unserialize which leads to a remote code execution (RCE) within versions 1.11.12 to 1.11.26. By abusing multiple supported features from the virtualization plugin vchamilo, the vulnerability allows an administrator to execute arbitrary code on the server. This issue has been patched in version 1.11.26.
CVSS Vector Analysis
Vector String
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XExploit Resources
Search for proof-of-concept code and exploit modules
Official References
Quick Information
Published
Mar 2, 2026
about 1 month ago
Last Modified
Mar 3, 2026
about 1 month ago
Vendor
chamilo
Product
chamilo lms
Related Vulnerabilities
This vulnerability allows an attacker to manipulate the database of the Chamilo learning management system by sending specially crafted data through a file upload feature, potentially exposing sensitive information or altering data. It affects versions prior to 1.11.30, so users need to update to this version or later to protect against this risk.
This vulnerability allows an attacker to manipulate the database of the Chamilo learning management system, potentially exposing sensitive information or altering data. It can be exploited by sending specially crafted requests to the system's index.php script, but it has been fixed in version 1.11.30, so users should update to that version to protect themselves.
This vulnerability allows an attacker to manipulate the database of the Chamilo learning management system by injecting harmful SQL commands through specific user input fields. It can be exploited by anyone sending crafted data to the application before version 1.11.30, potentially leading to unauthorized access or data manipulation.
This vulnerability allows an attacker to manipulate the database by injecting harmful SQL commands through specific scripts in the Chamilo learning management system, potentially leading to unauthorized access or data modification. It can be exploited by sending specially crafted requests to the affected scripts, and it has been fixed in version 1.11.30.
This vulnerability allows an attacker to run malicious code on the server hosting the Chamilo learning management system, potentially taking full control of it. It occurs when a specific request is sent without proper checks, and it affects versions prior to 1.11.28, which has since been patched.