CVE-2025-52476: Chamilo LMS Reflected XSS Vulnerability

CVE-2025-52476 Overview

CVE-2025-52476 is a reflected cross-site scripting (XSS) vulnerability affecting Chamilo, an open-source learning management system (LMS) widely used by educational institutions and organizations for e-learning. The vulnerability exists due to improper sanitization of the keyword_active parameter in the admin/user_list.php file, allowing attackers to inject malicious scripts that execute in the context of authenticated administrator sessions.

Critical Impact

Attackers can exploit this XSS vulnerability to steal administrator session cookies, perform unauthorized actions on behalf of administrators, or redirect users to malicious websites. Given that this affects the admin panel, successful exploitation could lead to full compromise of the LMS platform.

Affected Products

• Chamilo LMS versions prior to 1.11.30
• All installations with accessible admin/user_list.php endpoint
• Self-hosted Chamilo deployments without input sanitization patches

Discovery Timeline

• 2026-03-02 - CVE CVE-2025-52476 published to NVD
• 2026-03-03 - Last updated in NVD database

Technical Details for CVE-2025-52476

Vulnerability Analysis

This reflected XSS vulnerability stems from the application's failure to properly sanitize user-supplied input in the keyword_active parameter within the administrative user list functionality. When an administrator accesses a crafted URL containing malicious JavaScript in this parameter, the script is reflected back and executed in their browser session.

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), which represents a fundamental input validation failure. The attack requires user interaction—specifically, an administrator must click a malicious link—but given the administrative context, the potential impact includes session hijacking, credential theft, and unauthorized administrative actions within the LMS platform.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding in the admin/user_list.php file. The keyword_active parameter is accepted from user input and reflected back into the HTML response without proper sanitization or contextual escaping. This allows attackers to inject arbitrary HTML and JavaScript code that the browser interprets as legitimate content from the trusted domain.

Attack Vector

The attack is network-based and requires no authentication from the attacker's perspective, though it does require user interaction. An attacker would craft a malicious URL containing JavaScript payload in the keyword_active parameter and trick an authenticated Chamilo administrator into clicking the link through social engineering techniques such as phishing emails or malicious forum posts.

The malicious URL would target the admin/user_list.php endpoint with a crafted keyword_active parameter containing JavaScript code. When the administrator clicks the link while logged in, the injected script executes with their session privileges, potentially allowing the attacker to steal session tokens, modify user data, or perform other administrative actions.

Detection Methods for CVE-2025-52476

Indicators of Compromise

• Unusual access patterns to admin/user_list.php with encoded or suspicious keyword_active parameter values
• Web server logs showing URL-encoded JavaScript patterns such as %3Cscript%3E in query strings
• Unexpected administrative actions or user modifications without corresponding legitimate admin activity
• Reports from users of unexpected redirects or pop-ups when accessing admin panel links

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block XSS payloads in URL parameters targeting Chamilo admin endpoints
• Monitor HTTP access logs for requests to admin/user_list.php containing suspicious characters or encoded script tags
• Deploy content security policy (CSP) headers to restrict inline script execution and report violations
• Use SIEM correlation rules to detect anomalous admin panel access patterns combined with phishing indicators

Monitoring Recommendations

• Enable detailed logging for all administrative endpoints in Chamilo and forward logs to centralized SIEM
• Configure alerts for multiple failed or suspicious requests to user_list.php from external referrers
• Monitor for session token exfiltration attempts through network traffic analysis
• Review administrator account activity logs for actions that don't correlate with normal working hours or IP addresses

How to Mitigate CVE-2025-52476

Immediate Actions Required

• Upgrade Chamilo LMS to version 1.11.30 or later immediately
• Review web server access logs for any prior exploitation attempts targeting the keyword_active parameter
• Implement web application firewall rules to block XSS patterns in query parameters as a defense-in-depth measure
• Educate administrators about phishing risks and the importance of verifying URLs before clicking

Patch Information

Chamilo has addressed this vulnerability in version 1.11.30. The fix involves proper sanitization of the keyword_active parameter to prevent script injection. Organizations should upgrade to the patched version as soon as possible. The patch commit is available at the GitHub Commit, and the official release can be obtained from the GitHub Release v1.11.30.

For additional details, refer to the GitHub Security Advisory GHSA-pqjc-rvr9-w8m2.

Workarounds

• Restrict access to the Chamilo admin panel to trusted IP addresses using firewall rules or .htaccess configurations
• Deploy a web application firewall (WAF) with XSS protection rules to filter malicious requests before they reach the application
• Implement strict Content Security Policy (CSP) headers to prevent inline script execution even if XSS payloads reach the browser
• Consider placing the admin panel behind VPN access to reduce exposure to external attackers

# Example Apache .htaccess restriction for admin directory
<Directory "/var/www/chamilo/main/admin">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Directory>