CVE-2025-52563: Chamilo LMS Reflected XSS Vulnerability

CVE-2025-52563 Overview

CVE-2025-52563 is a reflected cross-site scripting (XSS) vulnerability in Chamilo LMS, an open source learning management system used by educational institutions and enterprises. The flaw exists in the session/add_users_to_session.php endpoint, where the page parameter is reflected into the response without sufficient sanitization. An attacker can craft a malicious URL that executes JavaScript in the victim's browser session when clicked. The vulnerability affects all Chamilo versions prior to 1.11.30 and is tracked under [CWE-79]. The Chamilo project addressed the issue in release 1.11.30.

Critical Impact
Attackers can execute arbitrary JavaScript in an authenticated user's browser context, enabling session hijacking, credential theft, or unauthorized actions within the LMS.

Affected Products

Chamilo LMS versions prior to 1.11.30
Vendor: Chamilo
Component: session/add_users_to_session.php endpoint

Discovery Timeline

2026-03-02 - CVE-2025-52563 published to NVD
2026-03-03 - Last updated in NVD database

Technical Details for CVE-2025-52563

Vulnerability Analysis

The vulnerability is a reflected XSS issue in Chamilo LMS. The add_users_to_session.php script accepts a page query parameter and embeds the value in the rendered HTML output without performing adequate output encoding or input validation. When a victim loads a crafted URL, the injected payload executes in the browser under the origin of the Chamilo deployment.

Reflected XSS requires user interaction, typically through a phishing link or a malicious page that redirects the victim. The attack succeeds when an authenticated user with session privileges visits the URL. Because the vulnerable endpoint is part of the session management workflow, the affected user population often includes administrators and trainers who manage user enrollments.

Exploitation does not require authentication on the attacker side, but a successful attack relies on a victim who is authenticated to the Chamilo instance. The injected script runs with the same privileges as the victim, allowing the attacker to interact with the application as that user.

Root Cause

The root cause is insufficient sanitization and output encoding of the page parameter inside session/add_users_to_session.php. User-controlled input flows into HTML context without escaping, which allows JavaScript payloads embedded in the parameter value to execute.

Attack Vector

Attackers deliver a crafted URL containing a malicious payload in the page parameter to an authenticated Chamilo user. When the victim clicks the link, the server reflects the payload into the response and the browser executes it. Possible outcomes include theft of session cookies, forced actions inside the LMS, defacement of rendered pages, or pivoting to internal endpoints accessible to the victim.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-h3m8-53j3-xjx8 for vendor-confirmed technical details.

Detection Methods for CVE-2025-52563

Indicators of Compromise

Web server access logs showing requests to /main/session/add_users_to_session.php containing suspicious characters in the page parameter, such as <script, onerror=, javascript:, or URL-encoded equivalents like %3Cscript.
Referrer headers pointing to untrusted external domains immediately preceding requests to the vulnerable endpoint.
Unexpected outbound requests from administrator browsers to attacker-controlled hosts shortly after visiting Chamilo URLs.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the page query parameter on add_users_to_session.php for HTML or JavaScript metacharacters.
Review HTTP server logs for anomalous query strings targeting the affected endpoint, focusing on long or encoded page values.
Correlate authentication events with subsequent suspicious account modifications that may indicate session abuse.

Monitoring Recommendations

Enable verbose access logging on the Chamilo web tier and forward logs to a centralized analytics platform.
Alert on Content Security Policy (CSP) violation reports if CSP is enforced on the Chamilo deployment.
Track administrator and trainer account activity for unexpected enrollment changes or privilege modifications.

How to Mitigate CVE-2025-52563

Immediate Actions Required

Upgrade Chamilo LMS to version 1.11.30 or later, which contains the official patch for this vulnerability.
Inventory all Chamilo deployments, including staging and test environments, to confirm patch coverage.
Notify administrators and trainers to avoid clicking unsolicited links to the Chamilo instance until patching is complete.

Patch Information

The Chamilo project released the fix in Chamilo LMS v1.11.30. Details are documented in the GitHub Security Advisory GHSA-h3m8-53j3-xjx8. Administrators should follow the standard Chamilo upgrade procedure and verify the version string after deployment.

Workarounds

Restrict access to session/add_users_to_session.php at the reverse proxy or WAF layer until upgrade is possible.
Add a WAF signature that blocks requests containing HTML tags or JavaScript event handlers in the page parameter.
Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of reflected XSS payloads.

bash

# Example nginx rule to block script-like content in the page parameter
location ~* /session/add_users_to_session\.php$ {
    if ($arg_page ~* "(<|%3C)\s*script|javascript:|onerror=|onload=") {
        return 403;
    }
}