CVE-2025-50190: Chamilo: Error-based SQL Injection via GET openid.assoc_handle with the /index.php script

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-02 · updated 2026-06-17
Weakness: CWE-89

Description

Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via the GET openid.assoc_handle parameter with the /index.php script. This issue has been patched in version 1.11.30.

Affected products

chamilo-lms: before 1.11.30 — fixed in 1.11.30

How to fix

Upgrade to a fixed version: chamilo-lms 1.11.30. Check the vendor advisory for mitigations.

References

https://github.com/chamilo/chamilo-lms/commit/613eb19a0fac6dd49c233f32ad5428cd29d5a468
https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-5296-jxrr-pfwj

Get alerted when CVE-2025-50190 or the next vulnerability affects your stack