CVE-2025-50197: Chamilo LMS RCE Vulnerability

CVE-2025-50197 Overview

CVE-2025-50197 is an OS Command Injection vulnerability discovered in Chamilo, an open-source learning management system (LMS). The vulnerability exists in the /main/admin/sub_language_ajax.inc.php file, where the new_language POST parameter is not properly validated before being processed. This allows authenticated administrators to inject and execute arbitrary operating system commands on the underlying server.

Critical Impact

Authenticated attackers with administrative privileges can execute arbitrary OS commands on the server, potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.

Affected Products

• Chamilo LMS versions prior to 1.11.30
• All installations using the multi-language administration feature
• Self-hosted Chamilo deployments with administrative access enabled

Discovery Timeline

• 2026-03-02 - CVE CVE-2025-50197 published to NVD
• 2026-03-03 - Last updated in NVD database

Technical Details for CVE-2025-50197

Vulnerability Analysis

This OS Command Injection vulnerability arises from insufficient input validation in Chamilo's sub-language administration module. The affected endpoint /main/admin/sub_language_ajax.inc.php processes language variable inputs without adequate sanitization, allowing malicious payloads to be interpreted as system commands.

The vulnerability requires administrative privileges to exploit, as the affected endpoint is protected by api_protect_admin_script(). However, once an attacker gains admin access—through credential theft, social engineering, or another vulnerability—they can leverage this flaw to achieve remote code execution on the server.

The attack is network-accessible and requires no user interaction beyond the initial authentication, making it exploitable remotely by any administrator with malicious intent or compromised credentials.

Root Cause

The root cause of this vulnerability lies in the improper handling of the variable_language parameter. Prior to the patch, the application used only XSS sanitization via Security::remove_XSS() without validating that the input conforms to expected language variable naming conventions. This allowed specially crafted input containing shell metacharacters or command sequences to be processed by the server.

The absence of a strict whitelist pattern for acceptable variable names meant that arbitrary strings, including those containing command injection payloads, could pass through the validation layer.

Attack Vector

The attack is executed via HTTP POST requests to the vulnerable endpoint. An authenticated administrator sends a crafted request with a malicious variable_language parameter containing OS command injection payloads. The server processes this input without proper validation, executing the embedded commands with the privileges of the web server process.

// Security patch showing the fix - Source: GitHub Commit
// Before: Only XSS sanitization was applied
api_protect_admin_script();

$new_language = Security::remove_XSS($_REQUEST['new_language']);
-$language_variable = Security::remove_XSS($_REQUEST['variable_language']);
+$language_variable = ltrim(
+    Security::remove_XSS($_REQUEST['variable_language']),
+    '$'
+);
$file_id = intval($_REQUEST['file_id']);

-if (isset($new_language) && isset($language_variable) && isset($file_id)) {
+$variableIsValid = isset($language_variable) && preg_match('/^[a-zA-Z_][a-zA-Z0-9_]*$/', $language_variable);
+
+if (isset($new_language) && $variableIsValid && isset($file_id)) {
    $file_language = $language_files_to_load[$file_id].'.inc.php';
    $id_language = intval($_REQUEST['id']);
    $sub_language_id = intval($_REQUEST['sub']);

Source: GitHub Commit e1c7879

Detection Methods for CVE-2025-50197

Indicators of Compromise

• Unusual POST requests to /main/admin/sub_language_ajax.inc.php with malformed or suspicious variable_language parameters
• Web server access logs showing requests containing shell metacharacters (;, |, &, backticks, $()) in language-related parameters
• Unexpected process spawning from the web server process (e.g., www-data or apache spawning bash, sh, or other command interpreters)
• Anomalous outbound network connections originating from the Chamilo application server

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block command injection patterns in POST parameters targeting Chamilo administrative endpoints
• Monitor web server logs for requests to sub_language_ajax.inc.php with parameters containing shell special characters or encoded command sequences
• Deploy endpoint detection and response (EDR) solutions to alert on suspicious process chains where web server processes spawn shell interpreters
• Review authentication logs for unusual administrative login patterns that may indicate account compromise

Monitoring Recommendations

• Enable verbose logging for the Chamilo admin interface and correlate with system-level process monitoring
• Configure SIEM rules to alert on HTTP POST requests to language management endpoints containing potential injection patterns
• Implement file integrity monitoring on Chamilo installation directories to detect unauthorized modifications
• Monitor for unexpected cron jobs, scheduled tasks, or persistent backdoors that may indicate post-exploitation activity

How to Mitigate CVE-2025-50197

Immediate Actions Required

• Upgrade Chamilo LMS to version 1.11.30 or later immediately, as this version contains the security patch
• Audit administrative account access and reset credentials for any accounts with potential exposure
• Review server logs for evidence of exploitation attempts targeting the sub_language_ajax.inc.php endpoint
• Implement network segmentation to limit the blast radius if the LMS server is compromised

Patch Information

Chamilo has released version 1.11.30 which addresses this vulnerability. The fix introduces strict input validation using a regular expression pattern (/^[a-zA-Z_][a-zA-Z0-9_]*$/) to ensure that language variable names contain only alphanumeric characters and underscores. Additionally, leading $ characters are stripped from the input before processing.

For detailed patch information, refer to the GitHub Commit e1c7879 and the GitHub Security Advisory GHSA-m76m-95c9-6h7r.

Workarounds

• Restrict access to the Chamilo administrative interface via IP allowlisting or VPN-only access until patching is complete
• Implement a Web Application Firewall rule to block POST requests to /main/admin/sub_language_ajax.inc.php as a temporary measure
• Disable the sub-language feature if not actively used by removing or restricting access to the affected PHP file
• Apply the principle of least privilege by limiting the number of administrator accounts and enforcing multi-factor authentication

# Example: Restrict access to vulnerable endpoint via Apache .htaccess
<Files "sub_language_ajax.inc.php">
    Order Deny,Allow
    Deny from all
    # Allow only trusted IPs until patch is applied
    Allow from 10.0.0.0/8
    Allow from 192.168.1.0/24
</Files>