CVE-2026-33714: 
Chamilo vulnerability analysis and mitigation

CVE-2026-33714 is an authenticated SQL injection vulnerability in Chamilo LMS version 2.0.0-RC.2, affecting the statistics AJAX endpoint (public/main/inc/ajax/statistics.ajax.php). It is an incomplete fix for CVE-2026-30881: while the prior patch sanitized date_start and date_end parameters in the get_user_registration_by_month action, the same parameters remain unsanitized in the users_active action within the same file. The vulnerability was published on April 14, 2026, and patched in Chamilo LMS version 2.0.0. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where user-supplied date_start and date_end parameters from $_REQUEST are directly interpolated into a SQL query string without any sanitization in the users_active action (lines 300–305 of statistics.ajax.php). The vulnerable code constructs a query fragment such as AND created_at BETWEEN '$startDate' AND '$endDate' using raw request input, enabling time-based blind SQL injection. Exploitation requires network access and admin-level authentication credentials. The advisory credits researcher morimori-dev for discovery via static source code analysis comparing the CVE-2026-30881 fix with the remaining vulnerable code path (GitHub Advisory).

An authenticated administrator can exploit this vulnerability to perform time-based blind SQL injection against the Chamilo LMS database, enabling extraction of arbitrary data including user credentials, personal information, course data, and other sensitive records. The confidentiality and integrity impacts are rated High, as an attacker can read and potentially manipulate database contents. Availability is not directly impacted by this vulnerability (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.03%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires admin-level authentication, which significantly limits the attacker pool (GitHub Advisory, Red Hat CVE).

1. Authenticate as Admin: Obtain valid administrator credentials for the target Chamilo LMS 2.0.0-RC.2 instance, either through credential theft, phishing, or brute force.
2. Identify the vulnerable endpoint: Locate the statistics AJAX endpoint at public/main/inc/ajax/statistics.ajax.php and confirm the users_active action is accessible.
3. Craft a malicious request: Send an HTTP request (GET or POST) to the endpoint with the action=users_active parameter and inject a time-based blind SQL payload into the date_start or date_end parameter, e.g., date_start=2024-01-01' AND SLEEP(5)-- -.
4. Observe time delay: If the server response is delayed by the specified sleep duration, the injection is confirmed as successful.
5. Extract data: Use automated tools such as sqlmap with session cookies to enumerate database tables, columns, and extract sensitive data (e.g., user credentials, personal information) via time-based blind SQL injection techniques (GitHub Advisory).

• Network: Unusual or repeated HTTP requests to /main/inc/ajax/statistics.ajax.php with action=users_active and anomalous date_start/date_end parameter values containing SQL syntax (e.g., single quotes, SLEEP, BENCHMARK, AND, OR keywords).
• Logs: Web server access logs showing requests to the statistics AJAX endpoint with encoded or malformed date parameters; abnormally slow response times on requests to this endpoint suggesting time-based injection.
• Logs: Application logs recording SQL errors or unexpected query structures originating from the users_active action in statistics.ajax.php.
• Process: Unusual database query patterns with SLEEP() or BENCHMARK() functions appearing in database slow query logs.

Chamilo has released version 2.0.0 as the official fix, which applies Database::escape_string() to the date_start and date_end parameters in the users_active action. Organizations should upgrade to Chamilo LMS version 2.0.0 or later immediately. As a temporary workaround, restrict access to the statistics AJAX endpoint at the network or web server level, and limit admin account access to trusted users only. Monitoring admin accounts for suspicious activity targeting the statistics endpoint is also recommended (GitHub Advisory, Chamilo v2.0.0 Release).