Chamilo: Vulnerabilidad CSRF en la eliminación de proyectos

The primary impact of CVE-2025-59541 is the unauthorized deletion of projects within a Chamilo LMS course. An attacker can craft a malicious webpage that, when visited by an authenticated 'Trainer' user, triggers the project deletion action. This could lead to significant data loss, disruption of learning materials, and potential reputational damage for the institution using Chamilo. The attack requires the victim to be logged into Chamilo and visit the attacker-controlled page, but does not require any further interaction. Successful exploitation could compromise the integrity of course content and impact the learning experience for students.

Educational institutions and organizations utilizing Chamilo LMS are at risk, particularly those running versions prior to 1.11.34. Organizations with a large number of 'Trainer' accounts or those that allow users to easily share links to internal Chamilo resources are at higher risk. Shared hosting environments where multiple Chamilo instances reside on the same server could also be impacted.

• php / web: Examine access logs for GET requests to project deletion endpoints with suspicious referer headers.

grep 'project_delete.php' access.log | grep -i 'attacker.com'

• php / web: Monitor Chamilo application logs for unusual project deletion events, particularly those associated with Trainer accounts. • generic web: Use curl to test for project deletion functionality via GET requests without CSRF tokens.

curl -v -X GET 'https://chamilo.example.com/project_delete.php?project_id=123' -H 'Referer: https://attacker.com'

1. 2026-03-06Disclosure

   disclosure

1. Reservado2025-09-17
2. Publicada2026-03-06
3. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-59541 is to immediately upgrade Chamilo LMS to version 1.11.34 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Additionally, educate users about the risks of clicking on untrusted links and the importance of verifying the authenticity of websites before submitting sensitive actions. While a direct detection signature is difficult, monitor Chamilo logs for unusual project deletion activity originating from unexpected IP addresses or user agents.