CVE-2025-52470: Chamilo LMS Stored XSS Vulnerability

CVE-2025-52470 Overview

CVE-2025-52470 is a stored cross-site scripting (XSS) vulnerability affecting Chamilo LMS, a widely-used open-source learning management system. The vulnerability exists in the session_category_add.php script, where improper sanitization of the Category Name field allows privileged users to inject persistent JavaScript payloads. When other administrators or users access add_many_sessions_to_category.php, the injected script executes in their browser context, potentially compromising administrative sessions and enabling further attacks.

Critical Impact

Privileged attackers can inject persistent JavaScript payloads that execute in the context of administrative sessions, potentially leading to session hijacking, credential theft, or further compromise of the LMS platform.

Affected Products

• Chamilo LMS versions prior to 1.11.30
• Chamilo LMS installations with session category management functionality enabled
• Organizations using Chamilo for e-learning and course management

Discovery Timeline

• 2026-03-02 - CVE CVE-2025-52470 published to NVD
• 2026-03-03 - Last updated in NVD database

Technical Details for CVE-2025-52470

Vulnerability Analysis

This stored XSS vulnerability arises from insufficient input validation in Chamilo LMS's session category management functionality. The session_category_add.php script accepts user input for the Category Name field without properly sanitizing or encoding potentially malicious content. When a privileged user creates or modifies a session category with a crafted payload containing JavaScript code, that payload is stored directly in the database.

The stored payload is then retrieved and rendered without proper output encoding when other users access the add_many_sessions_to_category.php page. This creates a persistent attack vector where every user who views the affected page inadvertently executes the attacker's JavaScript code within their authenticated browser session.

The attack requires high privileges to exploit initially, but the impact extends to any user who subsequently views the compromised content. This includes administrators, making it particularly dangerous for session hijacking and privilege abuse scenarios.

Root Cause

The root cause of CVE-2025-52470 is the lack of proper input sanitization and output encoding in the session category management workflow. The Category Name field does not employ HTML entity encoding or use a sanitization library to strip or neutralize dangerous characters and script tags. The fix introduced by Chamilo implements the HTMLPurifier library with specific filters to remove malicious attributes and scripts from user-supplied content.

Attack Vector

The attack vector is network-based and requires an authenticated user with privileges to create or modify session categories. The attacker crafts a malicious Category Name containing JavaScript code (such as event handlers or script tags) and submits it through the legitimate interface. Once stored, the payload persists in the database and triggers when any user navigates to pages that display session category information, specifically add_many_sessions_to_category.php. The attack requires user interaction in that the victim must access the affected page for the payload to execute.

The security patch introduces the RemoveOnAttributes filter from the Chamilo HTMLPurifier component to sanitize input:

/* For licensing terms, see /license.txt */

+use Chamilo\CoreBundle\Component\HTMLPurifier\Filter\RemoveOnAttributes;
use Chamilo\CoreBundle\Entity\Course;
use Chamilo\CoreBundle\Entity\ExtraField;
use Chamilo\CoreBundle\Entity\Repository\SequenceResourceRepository;

Source: GitHub Commit

Detection Methods for CVE-2025-52470

Indicators of Compromise

• Unusual or suspicious JavaScript code in session category names within the Chamilo database
• Browser console errors or unexpected script executions when accessing session category management pages
• Audit log entries showing creation or modification of session categories with encoded HTML or script content
• Reports from users experiencing unexpected behavior or redirects when viewing session categories

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block XSS payloads in POST requests to session_category_add.php
• Monitor database entries in session category tables for suspicious patterns such as <script>, onerror=, onclick=, or other event handlers
• Enable Content Security Policy (CSP) headers to detect and report inline script execution attempts
• Review application logs for repeated category creation or modification by single users

Monitoring Recommendations

• Configure SentinelOne Singularity to monitor web application processes for suspicious JavaScript execution patterns
• Enable browser-based security monitoring to detect client-side script injection attempts
• Set up alerts for database modifications to session-related tables containing HTML or script content
• Regularly audit privileged user activity within the Chamilo LMS administrative interface

How to Mitigate CVE-2025-52470

Immediate Actions Required

• Upgrade Chamilo LMS to version 1.11.30 or later immediately to apply the official security patch
• Review existing session category names in the database for any suspicious or malicious content
• Temporarily restrict access to session category management functionality for non-essential users
• Implement input validation at the web server or WAF level as an additional defense layer

Patch Information

Chamilo has released version 1.11.30 which addresses this vulnerability by implementing proper input sanitization using the HTMLPurifier library with the RemoveOnAttributes filter. Organizations should upgrade to this version as the primary remediation. The patch can be obtained from the official GitHub release. Technical details about the fix are available in the GitHub Security Advisory GHSA-p4m6-gwhg-x89f.

Workarounds

• Implement Content Security Policy (CSP) headers with strict directives to prevent inline script execution as a defense-in-depth measure
• Deploy a web application firewall (WAF) with XSS detection rules to filter malicious payloads before they reach the application
• Restrict administrative access to trusted networks or IP ranges to limit the attack surface
• Manually sanitize existing session category names by removing any HTML or script content from the database

# Example CSP header configuration for Apache
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"