{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3achamilochamilo_lms2.0.0rc1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*","cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1:*:*:*:*:*:*","cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2:*:*:*:*:*:*","cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3:*:*:*:*:*:*","cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4:*:*:*:*:*:*","cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5:*:*:*:*:*:*","cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1:*:*:*:*:*:*","cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2:*:*:*:*:*:*","cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3:*:*:*:*:*:*","cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1:*:*:*:*:*:*","cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-35196"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-KX00007-CVE-2026-35196\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["cve-2026-35196","os command injection","chamilo lms","web application"],"_cs_type":"advisory","_cs_vendors":["Chamilo"],"content_html":"\u003cp\u003eChamilo LMS, an open-source learning management system, is susceptible to an OS Command Injection vulnerability (CVE-2026-35196) in versions prior to 2.0.0-RC.3. The vulnerability resides in the \u003ccode\u003emain/inc/ajax/gradebook.ajax.php\u003c/code\u003e endpoint, specifically within the \u003ccode\u003eexport_all_certificates\u003c/code\u003e action. An attacker can exploit this flaw by manipulating the \u003ccode\u003e_cid\u003c/code\u003e session variable. Due to insufficient sanitization, the \u003ccode\u003e_cid\u003c/code\u003e value is directly concatenated into a \u003ccode\u003eshell_exec()\u003c/code\u003e command string. This allows an attacker to inject shell metacharacters and execute arbitrary commands on the underlying server. Successful exploitation could grant an attacker full access to read system files and credentials, modify the application and database, or disrupt server availability. Version 2.0.0-RC.3 addresses and resolves this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a Chamilo LMS instance running a version prior to 2.0.0-RC.3.\u003c/li\u003e\n\u003cli\u003eThe attacker gains a valid session, potentially through legitimate login or other means.\u003c/li\u003e\n\u003cli\u003eThe attacker manipulates the \u003ccode\u003e_cid\u003c/code\u003e session variable, injecting shell metacharacters (e.g., \u003ccode\u003e;\u003c/code\u003e, \u003ccode\u003e|\u003c/code\u003e, \u003ccode\u003e\u0026amp;\u0026amp;\u003c/code\u003e) and a malicious command. This can be achieved through browser developer tools or intercepting/modifying HTTP requests.\u003c/li\u003e\n\u003cli\u003eThe attacker triggers the \u003ccode\u003eexport_all_certificates\u003c/code\u003e action in the \u003ccode\u003emain/inc/ajax/gradebook.ajax.php\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe application retrieves the attacker-controlled \u003ccode\u003e_cid\u003c/code\u003e value from the session using \u003ccode\u003eapi_get_course_id()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application concatenates the unsanitized \u003ccode\u003e_cid\u003c/code\u003e value into a \u003ccode\u003eshell_exec()\u003c/code\u003e command.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eshell_exec()\u003c/code\u003e function executes the injected command on the server.\u003c/li\u003e\n\u003cli\u003eThe attacker gains arbitrary command execution, allowing them to read sensitive files, modify the application, or disrupt the server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-35196 allows an attacker to execute arbitrary commands on the Chamilo LMS server. This could lead to the compromise of sensitive data, including system files, credentials, and database contents. An attacker can also modify the application, inject malicious code, or disrupt server availability, leading to a complete loss of confidentiality, integrity, and availability. The number of potential victims is related to the number of unpatched Chamilo LMS instances exposed to the internet. Sectors affected may include education and training organizations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Chamilo LMS to version 2.0.0-RC.3 or later to patch CVE-2026-35196.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Chamilo LMS OS Command Injection Attempt\u0026quot; to your SIEM and tune for your environment to detect attempts to exploit the vulnerability via web server logs.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious requests to \u003ccode\u003emain/inc/ajax/gradebook.ajax.php\u003c/code\u003e containing shell metacharacters in the \u003ccode\u003e_cid\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eImplement input validation and sanitization for all user-supplied data, especially session variables, to prevent command injection attacks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-16T17:57:21Z","date_published":"2024-01-29T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-chamilo-os-command-injection/","summary":"Chamilo LMS versions prior to 2.0.0-RC.3 are vulnerable to OS Command Injection via the _cid session variable in the export_all_certificates action, potentially leading to arbitrary command execution.","title":"Chamilo LMS OS Command Injection Vulnerability (CVE-2026-35196)","url":"https://feed.craftedsignal.io/briefs/2024-01-chamilo-os-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}