Chamilo LMS, a learning management system, contains a session fixation flaw in the file main/lp/aicc_hacp.php. The code accepts user-supplied parameters and assigns them directly to the PHP session ID before the system initializes. This weakness, classified as CWE‑384, allows an attacker to set a predetermined session identifier, potentially taking over a legitimate user’s session after the user accesses the vulnerable page.

All deployments of Chamilo LMS running a version earlier than 1.11.38 or 2.0.0‑RC.3 are vulnerable. The flaw resides in the public‑facing aicc_hacp.php endpoint. Any installation that has not applied the recent patch remains at risk.

The vulnerability carries a CVSS score of 7.5, indicating high severity, and the EPSS score is not available, so the global exploitation probability cannot be quantified. The issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote HTTP request targeting the aicc_hacp.php endpoint where an attacker can supply a chosen session ID. If successful, the attacker would assume the victim’s privileges, compromising confidentiality, integrity, and availability of the LMS and any protected content. This assessment is inferred from the description because the exploit path is not explicitly detailed in the input.