CVE-2025-59542: Chamilo LMS Stored XSS Vulnerability

CVE-2025-59542 Overview

CVE-2025-59542 is a stored Cross-Site Scripting (XSS) vulnerability affecting Chamilo, an open-source learning management system. Prior to version 1.11.34, the course learning path Settings field lacks proper input sanitization, allowing attackers with low-privileged accounts (such as trainers) to inject malicious JavaScript code. When other users, including administrators, view the affected course information page, the injected script executes in their browser context.

Critical Impact

This stored XSS vulnerability enables attackers to exfiltrate sensitive session cookies and tokens, potentially leading to complete account takeover (ATO) of higher-privileged users including administrators.

Affected Products

• Chamilo LMS versions prior to 1.11.34
• All installations with user-editable learning path Settings fields
• Multi-tenant Chamilo deployments where trainers can modify course content

Discovery Timeline

• 2026-03-06 - CVE-2025-59542 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2025-59542

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The flaw exists in how Chamilo LMS processes and renders user-supplied content in the learning path Settings field. When a trainer or other low-privileged user with course editing capabilities modifies the Settings field, the application fails to properly sanitize the input before storing it in the database and subsequently rendering it to other users.

The stored nature of this XSS vulnerability makes it particularly dangerous, as the malicious payload persists in the database and executes every time a user accesses the affected course information page. This differs from reflected XSS attacks that require tricking users into clicking malicious links. The vulnerability can be exploited remotely over the network and requires only low privileges (e.g., trainer role) and minimal user interaction (victim must view the affected page).

Root Cause

The root cause of CVE-2025-59542 is insufficient input validation and output encoding in the Chamilo LMS course management module. The learning path Settings field accepts arbitrary HTML and JavaScript content without proper sanitization. When this content is retrieved from the database and rendered in the browser, it executes as part of the trusted page context, bypassing same-origin policy protections.

Attack Vector

The attack vector is network-based, requiring an authenticated attacker with at least trainer-level privileges. The attacker injects malicious JavaScript code into the course learning path Settings field through the normal course editing interface. When any user with access to the course views the information page, the malicious script executes with that user's session context.

A successful exploitation allows the attacker to steal session cookies, capture authentication tokens, perform actions on behalf of the victim user, modify page content, redirect users to malicious sites, or leverage administrator access for further compromise of the Chamilo installation. The scope is changed (S:C in the CVSS vector), meaning the vulnerability can affect resources beyond its security scope.

Detection Methods for CVE-2025-59542

Indicators of Compromise

• Unusual JavaScript code or HTML tags present in course learning path Settings fields in the database
• Session cookies being transmitted to external domains
• Unexpected administrator account activities or privilege changes
• Browser console errors related to cross-origin requests from the Chamilo domain

Detection Strategies

• Implement database auditing to monitor for suspicious content patterns in the lp_settings or related tables
• Deploy web application firewalls (WAF) with XSS detection rules to identify injection attempts
• Enable Content Security Policy (CSP) reporting to detect inline script execution violations
• Monitor server access logs for unusual POST requests to course editing endpoints containing script tags

Monitoring Recommendations

• Configure browser security headers and CSP to restrict script sources and report violations
• Implement real-time alerting for database changes to course configuration fields
• Deploy SentinelOne Singularity XDR for comprehensive endpoint monitoring and threat detection
• Review user activity logs for trainers or low-privileged accounts making bulk course modifications

How to Mitigate CVE-2025-59542

Immediate Actions Required

• Upgrade Chamilo LMS to version 1.11.34 or later immediately
• Audit existing course learning path Settings fields for any injected malicious content
• Review administrator account sessions and force re-authentication for all privileged users
• Implement Content Security Policy headers to mitigate impact of any undetected payloads

Patch Information

Chamilo has released version 1.11.34 which addresses this stored XSS vulnerability. The patch implements proper input sanitization and output encoding for the learning path Settings field. Organizations should prioritize upgrading to this version to eliminate the vulnerability. For detailed release information, see the GitHub Release v1.11.34. Additional vulnerability details are available in the GitHub Security Advisory GHSA-pxrh-3rcp-h7m6.

Workarounds

• Temporarily restrict trainer and other low-privileged user access to course editing functionality until the patch can be applied
• Implement Web Application Firewall (WAF) rules to block common XSS payloads in form submissions to course editing endpoints
• Deploy strict Content Security Policy headers with script-src 'self' to prevent inline script execution
• Enable HTTP-only and Secure flags on all session cookies to limit the impact of cookie theft

# Example Apache configuration to add security headers
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"
    Header set X-Content-Type-Options "nosniff"
    Header set X-XSS-Protection "1; mode=block"
</IfModule>