Chamilo LMS up to 1.11.29 AJAX Endpoint behavioral workflow

Summaryinfo

A vulnerability, which was classified as critical, has been found in Chamilo LMS up to 1.11.29. This affects an unknown part of the component AJAX Endpoint. Performing a manipulation results in behavioral workflow. This vulnerability is known as CVE-2025-52469. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Chamilo LMS up to 1.11.29. It has been classified as critical. This affects an unknown functionality of the component AJAX Endpoint. The manipulation with an unknown input leads to a behavioral workflow vulnerability. CWE is classifying the issue as CWE-841. The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Chamilo is a learning management system. Prior to version 1.11.30, a logic vulnerability in the friend request workflow of Chamilo’s social network module allows an authenticated user to forcibly add any user as a friend by directly calling the AJAX endpoint. The attacker can bypass the normal flow of sending and accepting friend requests, and even add non-existent users. This breaks access control and social interaction logic, with potential privacy implications. This issue has been patched in version 1.11.30.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-52469 since 06/17/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available.

Upgrading to version 1.11.30 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-208174). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Content Management System

Vendor

• Chamilo

Name

• LMS

Version

• 1.11.0
• 1.11.1
• 1.11.2
• 1.11.3
• 1.11.4
• 1.11.5
• 1.11.6
• 1.11.7
• 1.11.8
• 1.11.9
• 1.11.10
• 1.11.11
• 1.11.12
• 1.11.13
• 1.11.14
• 1.11.15
• 1.11.16
• 1.11.17
• 1.11.18
• 1.11.19
• 1.11.20
• 1.11.21
• 1.11.22
• 1.11.23
• 1.11.24
• 1.11.25
• 1.11.26
• 1.11.27
• 1.11.28
• 1.11.29

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion