CVE-2026-45145 in LMS
Summary
by MITRE • 10/30/2026
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unserialize()` on `user_career.extra_data` retrieved from the database without the `allowed_classes: false` safety option. An attacker able to write crafted serialized PHP objects to that column, for example through a separate SQL injection, a compromised admin CSV import, or a lower-privilege admin panel, can instantiate arbitrary PHP objects and trigger POP gadget chains in autoloaded `Symfony`, `Doctrine`, or `Monolog` components. This permits arbitrary OS commands as the web server user, compromising server confidentiality, integrity, and availability. This issue is fixed in version 2.0.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
Chamilo LMS, a widely deployed open-source learning management system, contains a critical insecure deserialization vulnerability that allows for remote code execution under specific conditions. The flaw resides within the core library files `public/main/inc/lib/career.lib.php` and the cron job handler `public/main/cron/import_csv.php`. These components interact with user-specific data stored in the database column named `user_career.extra_data`. When processing this field, the application invokes PHP's native `unserialize()` function without implementing any safety mechanisms to restrict which classes can be instantiated. This lack of restriction is a fundamental security anti-pattern that transforms standard data storage into an attack vector for arbitrary code execution if an attacker gains control over the content of this database column.
The technical severity of this vulnerability stems from its ability to trigger PHP Object Injection, specifically leveraging POP (Property-Oriented Programming) gadget chains found in third-party libraries such as Symfony, Doctrine, and Monolog. These popular frameworks are commonly included in modern PHP applications like Chamilo LMS. When the vulnerable `unserialize()` call processes a crafted payload containing serialized objects from these libraries, it instantiates them without validation. This process allows an attacker to manipulate object properties and invoke magic methods that ultimately lead to arbitrary command execution on the server with the privileges of the web server user. Such access compromises the confidentiality, integrity, and availability of the entire system, potentially leading to full server compromise, data exfiltration, or service disruption.
Exploitation requires an attacker to write a crafted serialized PHP object into the `user_career.extra_data` column. This prerequisite can be achieved through several vectors depending on the existing attack surface within the Chamilo instance. A primary vector involves exploiting a separate SQL injection vulnerability that allows for direct database manipulation, enabling the insertion of malicious payloads directly into the target column. Alternatively, if an administrator account is compromised or if there are lower-privilege admin panels with insufficient input validation during CSV imports, attackers can leverage these administrative functions to inject the serialized payload via the import mechanism. The presence of multiple potential entry points increases the likelihood of successful exploitation in environments where other vulnerabilities may exist or where privilege boundaries are not strictly enforced.
From a classification perspective, this vulnerability aligns with CWE-502, which describes Deserialization of Untrusted Data. It also maps to MITRE ATT&CK techniques related to Command and Scripting Interpreter execution via PHP Object Injection, specifically falling under the broader category of Application Layer Attacks where attackers exploit application logic flaws rather than network protocol weaknesses. The use of POP chains indicates a sophisticated exploitation technique that relies on the internal structure of third-party libraries, making detection by standard signature-based tools difficult without specific behavioral monitoring for unusual object instantiation patterns in PHP environments.
Mitigation strategies must prioritize immediate patching and input validation hardening. The most effective remediation is to upgrade Chamilo LMS to version 2.0.1 or later, where the developers have addressed this issue by implementing proper safety options during deserialization operations. For organizations unable to immediately apply patches due to operational constraints, a temporary mitigation involves ensuring that no untrusted data can reach the `user_career.extra_data` column through SQL injection prevention measures such as parameterized queries and strict input sanitization. Additionally, administrators should enforce strong access controls on CSV import functionalities and administrative panels to prevent unauthorized users from injecting malicious payloads. Implementing web application firewalls with rules targeting PHP serialization patterns may also provide a layer of defense against exploitation attempts while permanent fixes are deployed.