Chamilo: CSRF Vulnerability in Project Deletion

The primary impact of CVE-2025-59541 is the unauthorized deletion of projects within a Chamilo LMS course. An attacker can craft a malicious page that, when visited by an authenticated user (specifically a Trainer role), triggers the project deletion action. This could lead to data loss, disruption of learning materials, and potential compromise of the course's integrity. The attacker does not need to know the user's password, only that the user is logged into Chamilo. Successful exploitation requires the target user to be authenticated within the LMS and to visit the attacker-controlled malicious page. The blast radius is limited to the scope of the course and the permissions of the Trainer role.

Educational institutions and organizations utilizing Chamilo LMS are at risk, particularly those running versions prior to 1.11.34. Organizations with a large number of 'Trainer' accounts or those that allow users to easily share links to internal Chamilo resources are at higher risk. Shared hosting environments where multiple Chamilo instances reside on the same server could also be impacted.

• php / web: Examine access logs for GET requests to project deletion endpoints with suspicious referer headers.

grep 'project_delete.php' access.log | grep -i 'attacker.com'

• php / web: Monitor Chamilo application logs for unusual project deletion events, particularly those associated with Trainer accounts. • generic web: Use curl to test for project deletion functionality via GET requests without CSRF tokens.

curl -v -X GET 'https://chamilo.example.com/project_delete.php?project_id=123' -H 'Referer: https://attacker.com'

1. 2026-03-06Disclosure

   disclosure

1. Reserviert2025-09-17
2. Veröffentlicht2026-03-06
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-59541 is to upgrade Chamilo LMS to version 1.11.34 or later, which includes the necessary anti-CSRF protections. If upgrading immediately is not feasible, consider implementing a Web Application Firewall (WAF) rule to block requests that lack CSRF tokens for project deletion endpoints. Additionally, educate users about the risks of clicking on links from untrusted sources. While a direct detection signature is difficult without specific application-level monitoring, reviewing Chamilo's access logs for unusual GET requests targeting project deletion endpoints might reveal suspicious activity. After upgrading, confirm the fix by attempting to delete a test project via a crafted GET request – it should be rejected.