Chamilo LMS IDOR Vulnerability Analysis (CWE-639)

Critical Vulnerability Information Vulnerability Summary Product: Chamilo LMS Version: 2.0.0 Beta 1 Vulnerability Type: IDOR (Insecure Direct Object Reference) CVE-ID: CWE-639 CVSS 3.1 Score: 6.5 (Medium) Vulnerability Description Multiple endpoints in Chamilo LMS are affected by an IDOR vulnerability. An authenticated attacker can manipulate data belonging to other users by modifying the parameter in POST requests, leading to unauthorized data modification or deletion. The issue arises because the code does not verify whether the user has permission to perform operations on other users' data. Affected Endpoints 1. DELETE Legal Consent Record: Attackers can delete legal consent records for any user. 2. Send Legal Term Acceptance: Attackers can mark users as having accepted legal terms. 3. Handle Privacy Request: Attackers can submit fake account deletion requests or revoke legal consents. Technical Details Vulnerable Code Location: The critical code lacks permission checks for the parameter, allowing unauthorized data manipulation. Remediation Recommendations Fix: Replace the from request parameters with the authenticated user’s ID. Alternative Fix: If the system requires managing other users’ data, implement appropriate permission checks. Business Impact 1. GDPR Violation: May result in violations of data protection regulations. 2. User Trust: Users may lose confidence in data protection. 3. Legal Risk: Legal consequences may be severe. Timeline 2025-01-05: Vulnerability discovered TBD: Vendor notification, patch release, and other steps not yet determined References Chamilo LMS GitLab and SecurityWiki links provided for further details on the vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Chamilo LMS IDOR Vulnerability Analysis (CWE-639)