CVE-2013-6787

Severity: medium (CVSS 6.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-12-05 · updated 2026-06-17
Weakness: CWE-89

Description

SQL injection vulnerability in the check_user_password function in main/auth/profile.php in Chamilo LMS 1.9.6 and earlier, when using the non-encrypted passwords mode set at installation, allows remote authenticated users to execute arbitrary SQL commands via the "password0" parameter.

Affected products

chamilo-lms: through 1.9.6; 1.8.6.2, 1.8.7, 1.8.7.1, 1.8.8.2, 1.8.8.4, 1.8.8.6 (+3)

References

http://archives.neohapsis.com/archives/bugtraq/2013-11/0141.html
http://www.exploit-db.com/exploits/30012
https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-10-2013-11-06-Moderate-risk-SQL-Injection-in-specific-unrecommended-case
https://www.htbridge.com/advisory/HTB23182
http://archives.neohapsis.com/archives/bugtraq/2013-11/0141.html
http://www.exploit-db.com/exploits/30012
https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-10-2013-11-06-Moderate-risk-SQL-Injection-in-specific-unrecommended-case
https://www.htbridge.com/advisory/HTB23182

Get alerted when CVE-2013-6787 or the next vulnerability affects your stack