Chamilo LMS Chaining Unauthenticated SQLi, Account Takeover,...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: http://blog.quarkslab.com/chamilo-lms-its-raining-0days-hallelujah-its-raining-0days.html
• Blog Title: Chamilo LMS: Chaining Unauthenticated SQLi, Account Takeover, and Course-Import File Write to Pre-Auth RCE
• Suggested Section: Pentesting Web > Web Vulnerabilities Methodology, with cross-links or subsections under SQL Injection, Account Takeover, Deserialization, File Inclusion/Path traversal, File Upload, SSRF, and XSS

🎯 Content Summary

Scope, provenance, and impact. The post reviews the open-source Chamilo Learning Management System through manual and AI-assisted code analysis. It states that the findings were reported to the vendor, fixed, and assigned the following identifiers: CVE-2026-61578, CVE-2026-61582, <a href='https:/...

🔧 Technical Details

Blind SQL injection through JSON query construction: If an unauthenticated endpoint concatenates a JSON field such as filters.groupOp into a SQL WHERE clause, an attacker can inject Boolean expressions or timing functions such as IF(condition,SLEEP(5),0). A valid course or tenant identifier can provide the required application context. Boolean-Based Blind SQLi can recover data bit-by-bit; the described method sends eight requests per byte, tests each bit position, and reconstructs database fields such as administrator records and reset tokens.

Password-reset token theft: Trigger a password-reset request for a privileged account, then use SQL injection to extract the stored reset-token field, such as confirmation_token. Submitting the recovered token to the reset endpoint with attacker-chosen passwords bypasses mailbox verification and turns blind database read access into account takeover.🤖 Agent Actions

Updated src/pentesting-web/deserialization/README.md with:

• Allowlisted-object property tampering without a POP chain.
• Backup/import metadata exploitation workflow.
• PHP serialized-string length handling.
• Chamilo course_info.dat arbitrary file-write example.
• Technical mitigations and numbered references to Quarkslab, Chamilo’s advisory, and PHP documentation.

Other techniques were already covered elsewhere, so they were not duplicated.

Validation passed: git diff --check, reference numbering, duplicate-section, and forbidden-source checks. mdbook was unavailable locally.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: http://blog.quarkslab.com/chamilo-lms-its-raining-0days-hallelujah-its-raining-0days.html

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web > Web Vulnerabilities Methodology, with cross-links or subsections under SQL Injection, Account Takeover, Deserialization, File Inclusion/Path traversal, File Upload, SSRF, and XSS".

Repository Maintenance:

• MD Files Formatting: 1031 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0