Summary
Chamilo LMS contains a stored cross-site scripting vulnerability in publicly reachable user profiles, where editable profile fields are rendered without effective server-side sanitization. An attacker with a student account, including one created through enabled self-registration, may inject content that executes in the browser of visitors such as administrators.
Chamilo LMS contains a stored cross-site scripting vulnerability in publicly reachable user profiles, where editable profile fields are rendered without effective server-side sanitization. An attacker with a student account, including one created through enabled self-registration, may inject content that executes in the browser of visitors such as administrators.
Affected context
The issue occurs in Chamilo LMS deployments where public user profiles are accessible through the /user/{username} endpoint and profile fields can be edited by a student-level user. Risk is increased when self-registration is enabled and when visitors with privileged sessions follow attacker-controlled profile links.
The issue occurs in Chamilo LMS deployments where public user profiles are accessible through the /user/{username} endpoint and profile fields can be edited by a student-level user. Risk is increased when self-registration is enabled and when visitors with privileged sessions follow attacker-controlled profile links.
Exploit preconditions
- Attack surface: Public user profile pages
- Required access: A ROLE_STUDENT account, or the ability to self-register when registration is enabled
- Trigger point: A visitor renders the attacker's public profile
- Why exploitation is possible: User-editable fields are rendered with autoescaping disabled and lack adequate server-side sanitization on input
- Attack surface: Public user profile pages
- Required access: A ROLE_STUDENT account, or the ability to self-register when registration is enabled
- Trigger point: A visitor renders the attacker's public profile
- Why exploitation is possible: User-editable fields are rendered with autoescaping disabled and lack adequate server-side sanitization on input
Why this happens
The vulnerability results from storing user-controlled profile content and later rendering it in a template with autoescaping disabled. Because the write path does not sufficiently sanitize or constrain the affected fields, browser-interpreted markup or script content can persist and execute for profile visitors. This behavior maps to CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as stored cross-site scripting.
The vulnerability results from storing user-controlled profile content and later rendering it in a template with autoescaping disabled. Because the write path does not sufficiently sanitize or constrain the affected fields, browser-interpreted markup or script content can persist and execute for profile visitors. This behavior maps to CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as stored cross-site scripting.
Potential impact
- An attacker may execute script in the security context of profile visitors
- Administrator sessions or authentication-related data could be exposed
- Session tokens, JWTs, or browser
localStoragecontents may be exfiltrated where accessible - Victims could be redirected to phishing pages or shown manipulated LMS content
- An attacker could potentially perform unauthorized actions as a victim
- An attacker may execute script in the security context of profile visitors
- Administrator sessions or authentication-related data could be exposed
- Session tokens, JWTs, or browser
localStoragecontents may be exfiltrated where accessible - Victims could be redirected to phishing pages or shown manipulated LMS content
- An attacker could potentially perform unauthorized actions as a victim
General mitigation guidance
Mitigation generally focuses on treating all profile fields as untrusted content throughout their lifecycle.
Common defensive patterns include:
- Applying context-aware output encoding by default in templates
- Removing unnecessary uses of disabled autoescaping
- Enforcing server-side allowlist-based HTML sanitization when rich text is required
- Validating and constraining profile-field formats and lengths on the write path
- Using secure cookie attributes and reducing the exposure of sensitive browser-stored tokens
- Limiting privileged actions and applying appropriate authorization checks
- Requiring administrative review or moderation for publicly rendered profile content where practical
Mitigation generally focuses on treating all profile fields as untrusted content throughout their lifecycle.
Common defensive patterns include:
- Applying context-aware output encoding by default in templates
- Removing unnecessary uses of disabled autoescaping
- Enforcing server-side allowlist-based HTML sanitization when rich text is required
- Validating and constraining profile-field formats and lengths on the write path
- Using secure cookie attributes and reducing the exposure of sensitive browser-stored tokens
- Limiting privileged actions and applying appropriate authorization checks
- Requiring administrative review or moderation for publicly rendered profile content where practical
How teams detect issues like this
Detection approaches may include:
- Static analysis for templates that disable autoescaping or render raw user-controlled values
- Code review checks tracing profile fields from request handling and storage to HTML output
- Tests that submit representative markup to every editable profile field and verify contextual encoding
- Dynamic application testing for persistent script execution on public profile pages
- Policy enforcement requiring approved sanitization libraries and secure templating defaults
- Automated security review tools to identify unsafe output contexts and missing validation
Detection approaches may include:
- Static analysis for templates that disable autoescaping or render raw user-controlled values
- Code review checks tracing profile fields from request handling and storage to HTML output
- Tests that submit representative markup to every editable profile field and verify contextual encoding
- Dynamic application testing for persistent script execution on public profile pages
- Policy enforcement requiring approved sanitization libraries and secure templating defaults
- Automated security review tools to identify unsafe output contexts and missing validation
