The vulnerability is an authenticated SQL injection in the Chamilo LMS statistics AJAX endpoint. An administrator can supply unsanitized date_start and date_end parameters in the users_active action, where they are directly interpolated into a SQL query. This allows a time‑based blind injection that enables the extraction of arbitrary data from the database, exposing confidential information and violating data confidentiality. The weakness is a classic SQL injection (CWE‑89) and is evidenced by the missing input sanitization.

Chamilo LMS version 2.0.0‑RC2 is affected. The flaw resides in public/main/inc/ajax/statistics.ajax.php. All installations running this release run the risk of exploitation.

The vulnerability carries a high severity measured by a CVSS score of 7.1. Exploitability is constrained to authenticated administrators; an attacker must first compromise an admin account or benefit from a privileged role. Time‑based blind attacks can be performed with minimal user interaction, but they can be detectable due to the delay introduced. The EPSS score is not available, and the flaw is currently not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting that there are no widespread public exploitation reports yet. Nevertheless, an organization that experiences admin credential compromise can exploit the flaw to exfiltrate data.