CVE-2020-23128: 
Chamilo vulnerability analysis and mitigation

Chamilo LMS 1.11.10 contains a privilege escalation vulnerability (CVE-2020-23128) that allows a user with Sessions administrator privileges to create a new user and then escalate that user's privileges to administrator level through improper privilege management (NVD, AttackerKB).

The vulnerability exists in the user edit functionality of Chamilo LMS 1.11.10. A Sessions administrator can create a new user account and then modify the request body during the user edit operation to elevate the new user's privileges to administrator level. This is possible due to improper validation of privilege changes in the user edit function (ToanDang Blog).

The vulnerability allows privilege escalation from Sessions administrator to full administrator access. A malicious user could create new administrator accounts, potentially leading to complete compromise of the Chamilo LMS instance (NVD).

The vulnerability requires an authenticated user with Sessions administrator privileges. The exploit can be executed by intercepting and modifying the user edit request using tools like Burp Suite. A proof of concept demonstrates creating a new user account and modifying its privileges through request manipulation (ToanDang Blog).