CVE-2026-45146— Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificated

Quick assessment

Affected

chamilo chamilo-lms

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Chamilo LMS 是一款开源学习管理系统。在 1.11.40 和 2.0.1 版本之前，已认证的管理员可以在中调用操作，并设置，同时传入一个精心构造的 JSON 格式参数，其中字段包含 SQL 语法。由于该字段在纳入查询逻辑之前未被限制为预期的或运算符，攻击者可控的输入会被数据库解析，从而引发盲注或基于时间的 SQL 注入。成功利用此漏洞可泄露敏感的用户、课程、会话、配置、密码重置及管理员数据；在具备相应数据库权限的情况下，还可修改或删除相关记录；此外，通过执行高开销的延迟查询，可导致拒绝服务

CVSS 7.2 · High Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1059.006 · Python T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificated

Source: CVE Program / CVE List V5

Vulnerability Description

Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the get_sessions action in /main/inc/ajax/model.ajax.php with _search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is not restricted to the expected AND or OR operators before it is incorporated into query logic, attacker-controlled input is interpreted by the database and enables blind or time-based SQL injection. Successful exploitation can disclose sensitive user, course, session, configuration, password-reset, and administrative data, modify or delete records subject to database privileges, and cause denial of service through expensive delayed queries. This issue is fixed in versions 1.11.40 and 2.0.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
chamilo	chamilo-lms	< 1.11.40	-

II. Public POCs for CVE-2026-45146

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-45146

请登录查看更多情报信息。

Vendor Pages for CVE-2026-45146 (2)

🔗 Release v2.0.1 · chamilo/chamilo-lms · GitHub x_refsource_MISC
🔗 Release v1.11.40 · chamilo/chamilo-lms · GitHub x_refsource_MISC

Other References for CVE-2026-45146 (3)

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-prqp-8x29-cr88 x_refsource_CONFIRM
https://github.com/chamilo/chamilo-lms/commit/4472f3089bbbca1b4713bfd7059907676b80d07f x_refsource_MISC
https://github.com/chamilo/chamilo-lms/commit/7cc961d60ac27eaccd6bcc8db201de2c65adfdf3 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-45146

IV. Related Vulnerabilities

Same product: chamilo-lms

Same vendor: chamilo

Same weakness: CWE-89