Chamilo LMS suffers from an unauthenticated SQL injection through the custom_dates parameter in chamiko-lms model.ajax.php. The flaw allows attackers to execute arbitrary SQL statements against the server database, enabling them to read, modify, and delete data. By chaining this injection with a legacy password reset feature that uses predictable tokens, an attacker can gain full administrative control of the application, compromising all PII and configuration stored in the database. The weakness is documented as CWE-89.

The vulnerability affects all installations of Chamilo Learning Management System running versions prior to 1.11.34. The product is identified by the CPE cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*. All vendor releases before 1.11.34 are impacted.

The CVSS score 9.3 indicates critical severity, and the EPSS score of less than 1% suggests moderate likelihood of exploitation at present. Despite the low EPSS, the lack of authentication required for exploitation and the potential for complete administrative takeover make this a high risk vulnerability. The issue is not currently listed in the CISA KEV catalog. An attacker can reach the vulnerable endpoint remotely via the web interface, send a malicious custom_dates payload, and immediately gain database access and control.