CVE-2025-59541: Chamilo LMS CSRF Vulnerability

CVE-2025-59541 Overview

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in Chamilo, an open-source learning management system (LMS). Prior to version 1.11.34, the application fails to implement proper anti-CSRF protections for sensitive actions, specifically project deletion within courses. This security flaw allows attackers to craft malicious web pages that, when visited by an authenticated Trainer user, will execute unauthorized project deletion requests without the victim's knowledge or consent.

Critical Impact

Authenticated Trainer users can be tricked into deleting course projects without consent, potentially resulting in significant data loss and disruption to educational activities.

Affected Products

• Chamilo LMS versions prior to 1.11.34
• All Chamilo LMS installations using default project management functionality
• Educational institutions and organizations running vulnerable Chamilo deployments

Discovery Timeline

• 2026-03-06 - CVE-2025-59541 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2025-59541

Vulnerability Analysis

This vulnerability stems from the absence of Cross-Site Request Forgery (CWE-352) protections in the Chamilo LMS project deletion functionality. The application accepts GET-based requests for destructive operations without validating that the request originated from a legitimate user action within the application. This design flaw violates secure coding best practices, which mandate that state-changing operations require proper CSRF token validation.

The attack requires user interaction—specifically, an authenticated Trainer must visit a malicious webpage crafted by the attacker. However, no additional privileges beyond standard Trainer authentication are needed, and the attack can be executed entirely over the network without direct access to the target system.

Root Cause

The root cause of this vulnerability is the failure to implement anti-CSRF token mechanisms for sensitive operations. The project deletion endpoint accepts requests via GET method without verifying the origin of the request or validating a session-bound CSRF token. This allows any authenticated session to be exploited through cross-origin requests initiated by attacker-controlled content.

Additionally, the use of GET requests for state-changing operations violates the HTTP specification, which recommends that GET requests should be safe and idempotent. Destructive actions like project deletion should exclusively use POST, PUT, or DELETE methods with proper CSRF protections.

Attack Vector

The attack is conducted over the network and requires the victim to be authenticated as a Trainer in the Chamilo LMS system. The attacker creates a malicious webpage containing hidden elements (such as image tags, iframes, or JavaScript) that trigger requests to the vulnerable project deletion endpoint. When a Trainer visits this malicious page while logged into Chamilo, their browser automatically includes session cookies with the request, causing the deletion to execute under their authenticated session.

The vulnerability leverages GET-based requests for deletion operations, meaning the attack can be as simple as embedding an image tag with the deletion URL as its source. No user confirmation or additional interaction beyond visiting the malicious page is required for the attack to succeed.

Detection Methods for CVE-2025-59541

Indicators of Compromise

• Unexpected project deletions in course audit logs without corresponding user activity
• Multiple deletion requests originating from unusual referrer URLs or external domains
• Trainer accounts showing deletion activity during periods of inactivity or unusual hours
• Web server logs indicating GET requests to project deletion endpoints with external referrers

Detection Strategies

• Monitor web application logs for project deletion requests with suspicious or empty referrer headers
• Implement anomaly detection for bulk or rapid project deletions across multiple courses
• Review access logs for patterns indicating automated or scripted deletion requests
• Deploy web application firewall (WAF) rules to detect and block CSRF attack patterns

Monitoring Recommendations

• Enable detailed audit logging for all project management operations in Chamilo LMS
• Configure alerting for deletion operations performed via GET requests with external referrers
• Implement session activity monitoring to correlate user actions with expected behavior patterns
• Regularly review security logs for signs of social engineering or phishing attempts targeting Trainers

How to Mitigate CVE-2025-59541

Immediate Actions Required

• Upgrade Chamilo LMS to version 1.11.34 or later immediately
• Review project deletion audit logs to identify any unauthorized deletions
• Educate Trainer users about the risks of clicking unknown links while authenticated
• Consider implementing additional WAF rules to block suspicious CSRF patterns during the upgrade window

Patch Information

Chamilo has released version 1.11.34 which addresses this CSRF vulnerability. The patch implements proper anti-CSRF token validation for sensitive operations including project deletion. Organizations should review the Chamilo LMS Release v1.11.34 for complete release notes and upgrade instructions. Additional details about this security issue are available in the GitHub Security Advisory GHSA-rpj6-p9m5-q637.

Workarounds

• Restrict Trainer access to project deletion functionality through role-based permissions if supported
• Implement network-level controls to limit access to the Chamilo administration interface
• Deploy a reverse proxy or WAF with CSRF protection capabilities in front of Chamilo
• Advise users to log out of Chamilo before browsing other websites to minimize exposure

# Example: WAF rule to block suspicious project deletion requests
# This is a generic ModSecurity rule pattern - adjust for your environment
SecRule REQUEST_URI "@contains /delete_project" \
    "id:100001,phase:2,deny,status:403,\
    chain,log,msg:'Potential CSRF on project deletion'"
SecRule REQUEST_HEADERS:Referer "!@contains your-chamilo-domain.com"