CVE-2025-50190: Chamilo LMS SQL Injection Vulnerability

CVE-2025-50190 Overview

CVE-2025-50190 is an error-based SQL Injection vulnerability affecting Chamilo, an open-source learning management system (LMS). The vulnerability exists in versions prior to 1.11.30 and can be exploited through the GET openid.assoc_handle parameter within the /index.php script. This flaw allows unauthenticated attackers to execute arbitrary SQL queries against the backend database, potentially leading to unauthorized data access or system compromise.

Critical Impact

Unauthenticated attackers can exploit this SQL Injection vulnerability to extract sensitive data from the database, including user credentials, course materials, and administrative information stored within the Chamilo LMS platform.

Affected Products

• Chamilo LMS versions prior to 1.11.30
• All installations using the vulnerable /index.php OpenID authentication handler
• Self-hosted and on-premises Chamilo deployments

Discovery Timeline

• 2026-03-02 - CVE-2025-50190 published to NVD
• 2026-03-03 - Last updated in NVD database

Technical Details for CVE-2025-50190

Vulnerability Analysis

This vulnerability is classified as CWE-89 (SQL Injection), a critical web application security flaw that occurs when user-supplied input is improperly incorporated into SQL queries. In the case of CVE-2025-50190, the Chamilo LMS fails to properly sanitize the openid.assoc_handle GET parameter before using it in database queries within the /index.php script.

The error-based nature of this SQL Injection means that attackers can extract database information through carefully crafted payloads that cause the database to return error messages containing sensitive data. This technique is particularly effective because it doesn't require the application to directly display query results—instead, error messages reveal the requested information.

The network-based attack vector with no authentication requirements makes this vulnerability particularly dangerous for publicly accessible Chamilo installations, as any internet-connected attacker could potentially exploit it.

Root Cause

The root cause of CVE-2025-50190 is insufficient input validation and sanitization of the openid.assoc_handle parameter in the Chamilo LMS authentication flow. The application directly incorporates user-supplied values into SQL queries without using parameterized queries or proper escaping mechanisms, allowing attackers to inject malicious SQL syntax.

Attack Vector

The attack is conducted over the network by sending a specially crafted HTTP GET request to the /index.php endpoint with a malicious payload in the openid.assoc_handle parameter. Since no authentication is required, any remote attacker can exploit this vulnerability against exposed Chamilo instances.

The exploitation involves injecting SQL syntax that causes database errors containing extracted data, such as table names, column structures, or sensitive record contents. The attacker analyzes the error responses to systematically enumerate and extract database information.

Detection Methods for CVE-2025-50190

Indicators of Compromise

• Unusual HTTP GET requests to /index.php containing SQL keywords or special characters in the openid.assoc_handle parameter
• Database error messages appearing in web server logs referencing the OpenID authentication functionality
• Unexpected database query patterns or increased database error rates
• Evidence of data exfiltration or unauthorized access to user accounts

Detection Strategies

• Configure Web Application Firewalls (WAF) to detect and block SQL injection patterns in the openid.assoc_handle parameter
• Implement intrusion detection rules to monitor for characteristic SQL injection payloads targeting the /index.php endpoint
• Enable database query logging and monitor for unusual or malformed queries originating from the web application
• Deploy SentinelOne Singularity to detect exploitation attempts and anomalous database access patterns

Monitoring Recommendations

• Enable verbose logging for the Chamilo LMS application and web server to capture suspicious request parameters
• Monitor database server logs for SQL syntax errors that may indicate exploitation attempts
• Implement alerting for multiple failed or unusual authentication requests to the OpenID handler
• Conduct regular security scans of Chamilo installations to identify unpatched versions

How to Mitigate CVE-2025-50190

Immediate Actions Required

• Upgrade Chamilo LMS to version 1.11.30 or later immediately
• If immediate patching is not possible, consider temporarily disabling OpenID authentication functionality
• Implement WAF rules to block requests containing SQL injection patterns in the openid.assoc_handle parameter
• Review database access logs for evidence of prior exploitation attempts

Patch Information

Chamilo has released version 1.11.30 which addresses this SQL Injection vulnerability. The fix is available through the official GitHub release. Organizations should review the security advisory GHSA-5296-jxrr-pfwj and the associated commit for technical details on the patch implementation.

Workarounds

• Deploy a Web Application Firewall (WAF) with SQL injection detection rules to filter malicious requests before they reach the application
• Restrict network access to Chamilo LMS installations to trusted IP ranges where possible
• Disable OpenID authentication functionality if not required for business operations
• Implement database-level monitoring and access controls to limit potential impact of successful exploitation

# Example WAF rule to block SQL injection in openid.assoc_handle parameter
# For ModSecurity-compatible WAFs
SecRule ARGS:openid.assoc_handle "@detectSQLi" \
    "id:1001,phase:2,deny,status:403,log,msg:'SQL Injection attempt in openid.assoc_handle'"