CVE-2025-52475: Chamilo LMS Reflected XSS Vulnerability

CVE-2025-52475 Overview

CVE-2025-52475 is a reflected cross-site scripting (XSS) vulnerability discovered in Chamilo, an open-source learning management system (LMS). The vulnerability exists in the admin/user_list.php endpoint where the keyword_inactive parameter is not properly sanitized, allowing attackers to inject malicious JavaScript code through a crafted URL.

This vulnerability affects Chamilo LMS installations prior to version 1.11.30. When an administrator clicks a malicious link containing the crafted payload, the injected script executes in the context of their authenticated session, potentially allowing attackers to steal session cookies, perform unauthorized actions, or redirect users to malicious sites.

Critical Impact

Attackers can inject malicious JavaScript through the keyword_inactive parameter in the admin user list interface, potentially compromising administrator sessions and enabling further attacks against the LMS platform.

Affected Products

• Chamilo LMS versions prior to 1.11.30
• Installations with exposed admin/user_list.php endpoints

Discovery Timeline

• 2026-03-02 - CVE CVE-2025-52475 published to NVD
• 2026-03-03 - Last updated in NVD database

Technical Details for CVE-2025-52475

Vulnerability Analysis

The reflected XSS vulnerability in Chamilo LMS stems from inadequate input sanitization in the admin user management interface. The admin/user_list.php endpoint accepts a keyword_inactive parameter that is rendered directly in the page output without proper encoding or validation. This allows attackers to craft malicious URLs containing JavaScript payloads that execute when the page renders.

Since this is a reflected XSS vulnerability, the attack requires social engineering to trick an authenticated administrator into clicking a malicious link. Once clicked, the malicious script executes within the administrator's browser session with full access to the Chamilo application context.

Root Cause

The root cause is improper input validation and output encoding (CWE-79) in the admin/user_list.php file. The keyword_inactive parameter value is reflected back to the user in the HTML response without proper sanitization using functions like htmlspecialchars() or equivalent encoding mechanisms. This allows arbitrary HTML and JavaScript content to be injected into the page.

Attack Vector

The attack is network-based and requires user interaction. An attacker constructs a URL containing a malicious JavaScript payload in the keyword_inactive parameter and distributes this URL to target administrators through phishing emails, social media, or other means. When an authenticated administrator clicks the link, the payload executes in their browser with their session privileges.

The attack flow involves: crafting a malicious URL with JavaScript in the keyword_inactive parameter, distributing the URL to administrators via social engineering, and exploiting the reflected content when the victim accesses the malicious link while authenticated to the Chamilo LMS.

Detection Methods for CVE-2025-52475

Indicators of Compromise

• Web server access logs containing suspicious requests to admin/user_list.php with encoded JavaScript in the keyword_inactive parameter
• Unusual URL patterns with <script>, javascript:, onerror=, or other XSS payload indicators targeting the user list endpoint
• Reports from administrators of unexpected browser behavior or security warnings when accessing user management pages
• Browser console errors indicating blocked script execution from Content Security Policy violations

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block XSS payload patterns in URL parameters, particularly targeting the admin/user_list.php endpoint
• Enable detailed web server logging and create alerts for requests containing common XSS indicators such as <script>, javascript:, event handlers, and HTML entities in query parameters
• Deploy browser-based security monitoring to detect anomalous script execution in administrative interfaces
• Use SentinelOne Singularity XDR to monitor for suspicious browser activity and correlate web-based attack patterns

Monitoring Recommendations

• Configure log aggregation to capture and analyze all requests to Chamilo administrative endpoints
• Set up alerting for HTTP requests containing URL-encoded or double-encoded JavaScript patterns
• Monitor for unusual administrative session activity following access to the user list page
• Review administrator account activity for signs of session hijacking or unauthorized actions

How to Mitigate CVE-2025-52475

Immediate Actions Required

• Upgrade Chamilo LMS to version 1.11.30 or later, which contains the security fix for this vulnerability
• Restrict access to administrative interfaces using IP whitelisting or VPN requirements until the patch can be applied
• Implement or strengthen Content Security Policy (CSP) headers to mitigate the impact of any XSS attacks
• Educate administrators about phishing risks and the importance of verifying URLs before clicking

Patch Information

Chamilo has released version 1.11.30 to address this vulnerability. The fix is available in commit 349062d31533d464feea78d41996bc0857f90f61. Organizations should upgrade to this version as soon as possible. Detailed information about the security fix can be found in the GitHub Security Advisory GHSA-7p5f-34rx-49h8 and the official release notes for v1.11.30.

Workarounds

• Deploy a web application firewall (WAF) rule to filter requests containing XSS payloads in the keyword_inactive parameter
• Implement strict Content Security Policy headers to prevent inline script execution as a defense-in-depth measure
• Restrict access to the admin/user_list.php endpoint to trusted IP addresses until the patch is applied
• Consider temporarily disabling the user search functionality if the risk is deemed unacceptable and patching is delayed

# Example Apache configuration to restrict admin access by IP
<Location "/chamilo/main/admin/">
    Require ip 10.0.0.0/8 192.168.0.0/16
</Location>