Stores XSS in update_users (< 1.11.40)

Summary

The update_users action of the AJAX endpoint main/inc/ajax/user_manager.ajax.php in Chamilo LMS 1.11.38 — already known to allow unauthenticated email rewrites in [[ADVISORY_V14]] — also accepts attacker-controlled values for the firstname, lastname, and email fields and persists them verbatim into the user table. These fields are then rendered without HTML escaping on multiple high-traffic pages (user_portal.php, the admin user listing, user information, social profile, course participant list, message-composer recipient header), giving an unauthenticated attacker stored Cross-Site Scripting against every user who views the injected account — including the platform administrator.

Impact

• Vulnerability class: Stored Cross-Site Scripting via Broken Access Control on the storage endpoint (CWE-79, CWE-862).
• Required privileges: none (pre-auth / unauthenticated).
• Affected version: Chamilo LMS 1.11.38.
• Consequence: An unauthenticated attacker persists arbitrary JavaScript into any user's profile fields. The payload executes in the browser session of every user who views any page that lists or shows the injected account, including administrators. Chained with [[ADVISORY_V14]] this gives the attacker both a loud takeover primitive (email change → password reset) and a silent persistent foothold (XSS fires for every viewer of the modified account). When the injected target is the platform administrator (default user_id=1), the payload is rendered to every logged-in user via user_portal.php, enabling cookie theft, in-session admin actions, or platform-wide malware delivery.

Status in later versions

Chamilo 1.11.36 (VULNERABLE)

The update_users branch of main/inc/ajax/user_manager.ajax.php is byte-identical between 1.11.36 and 1.11.38 (diff of lines 460-540 is empty). All confirmed render sinks (user_portal.php, main/admin/user_list.php, main/admin/user_information.php, main/social/profile.php, main/user/user.php, main/messages/new_message.php) exist at the same paths in 1.11.36, and user_portal.php is byte-identical to the 1.11.38 version. The chain reproduces verbatim.

Chamilo 2.0.0 (NOT APPLICABLE)

The update_users action no longer exists in chamilo-2.0.0/public/main/inc/ajax/user_manager.ajax.php — grep for case 'update_users' returns no match. The legacy injection endpoint is gone (consistent with [[ADVISORY_V14]]'s 2.0.0 status).

Author

• Sean MATTHEWS