Отправить #1025429: Chamilo Chamilo LMS <= 1.11.40 Stored XSS & HTML Injection

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Description
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
The Project creation/edit form under Chamilo’s Ticket module (main/ticket/projects.php) accepts a “name” parameter that is stored to the database without sanitization and rendered without output encoding wherever the project list is displayed within the Ticket module. This results in a persistent vulnerability exploitable at two levels: plain HTML injection (arbitrary tags render as-is) and full stored XSS (arbitrary JavaScript execution). Once a payload is saved into the Name field, it automatically triggers every time the project list is viewed, with no further interaction needed beyond loading the page.
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Details
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Root Cause

Input is stored without sanitization in TicketManager::addProject() / updateProject():
$project->setName($params['name']);

Output is rendered without encoding in TicketManager::getProjects():
'1' => $row->getName(),

No Security::remove_XSS() or htmlspecialchars() is applied at either the storage or rendering stage. The same class (main/inc/lib/TicketManager.php) already applies Security::remove_XSS() to the ticket “subject” field in getTicketsByCurrentUser(), confirming this sanitization was simply omitted for the Project “name” field.

Because the Name field value is rendered with zero output encoding, the vulnerability is exploitable at two distinct levels:

Plain HTML injection — arbitrary tags (headings, styling, embedded elements) are rendered as-is and can be used to deface the page or insert misleading content, with no JavaScript required.

Full stored XSS — event-handler-based payloads execute attacker-controlled JavaScript in the viewer’s session.

Both occur through the same unsanitized code path; the difference is purely in the payload used.

This is distinct from previously disclosed Chamilo ticket-module XSS issues:

CVE-2019-1000015 — ticket Subject field (ticket_details.php), fixed in 1.11.8
CVE-2024-27524 — uploaded attachment filename (new_ticket.php), fixed in 1.11.26
Neither covers projects.php or the Project “name” field.

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Proof of concept
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

1- Log in with an account that has access to main/ticket/projects.php.
2- Navigate to main/ticket/projects.php?action=add.
3- In the Name field, enter one of the payloads below.
4- Submit the form. The payload renders/executes immediately on the post-save redirect.
5- It continues to render/execute automatically on every subsequent visit to main/ticket/projects.php, and on any other ticket-module page where the project list is rendered — no click or further interaction is required once the page has loaded.

Proof of Concept Payloads:

HTML injection Rendered:

<h1 style="color:red">Fake Heading Injected Here</h1>
<i> tag
<b> bold tag
<form></form> tag
<input> Tag
Stored XSS (JavaScript execution):

<img src=x onerror=alert(1020)>
<a href="javascript:alert(document.cookie)">clickme</a>
<a href="javascript:alert(document.domain)">clickme</a>

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Impact
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

1- Confirmed: arbitrary JavaScript execution in the session of any user who loads a page rendering the stored project data.
2- Session hijacking: if the session cookie is not HttpOnly-protected, the injected script can read and exfiltrate it directly via document.cookie, allowing an attacker to steal and reuse the victim’s session.
3- Even where the session cookie is HttpOnly, the injected script can still perform authenticated actions on the victim’s behalf using fetch()/XMLHttpRequest (the browser attaches the session cookie automatically to these requests regardless of HttpOnly).
4- Fake form injection: the injected script can render a fake HTML form (e.g. styled to look like a login prompt or a normal part of the page) over the real content. Any data the victim submits into that form — such as credentials — is captured by the attacker, enabling phishing/credential harvesting.
5- The injected script can also exfiltrate any other accessible cookies or tokens, or otherwise alter the page content and UI shown to the victim.

• Источник: ⚠️ https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-wj7h-p8jp-jqxw
• Пользователь: M. Zaeem Shafqat (UID 102031)
• Представление: 12.10.2026 12:50 (6 дни назад)
• Модерация: 18.10.2026 09:56 (6 days later)
• Статус: принято
• Запись VulDB: 421679 [Chamilo LMS до 1.11.40/2.0.3/3.0.1 Ticket TicketManager.php addProject name межсайтовый скриптинг]
• Баллы: 20