Chamilo Learning Management System allows database changes in skill‑management AJAX actions without CSRF protection. An attacker who tricks an authenticated administrator into visiting a malicious page can create, edit, or delete skill records, update profiles, or unlink skill‑gradebook associations, compromising the integrity of learning data. The flaw is a classic Cross‑Site Request Forgery issue (CWE‑352) that does not provide remote code execution but still permits destructive data manipulation for privileged users.

Versions of Chamilo LMS prior to 2.0.1 are affected. The flaw resides in public/main/inc/ajax/skill.ajax.php within the chamilo:chamilo‑lms product, and the reported fix started in release 2.0.1.

The vulnerability receives a CVSS score of 6.5, indicating moderate severity, and is not present in CISA’s KEV catalog. Exploitation requires an authenticated administrator to visit a crafted page by the attacker. Once the admin performs a normal request, the missing CSRF check permits the attacker to submit the same request from the malicious page, causing unauthorized database changes. Because the attack vector relies on user interaction but performs straightforward HTTP requests, the risk is significant for institutions that rely on Chamilo for managing academic data and may lack stringent access controls.