CVE-2026-28430 is an unauthenticated SQL injection in Chamilo LMS, a learning management system, reachable through the custom_dates parameter. Chained with a predictable legacy password reset, it can lead to full administrator takeover. NVD scores it 9.8. Upgrade to Chamilo 1.11.34 or the 2.0 line.
What's affected
The GitHub advisory GHSA-84gw-qjw9-v8jv lists affected versions 1.11.32 and earlier and patched versions 1.11.34 and 2.0. NVD's description says versions prior to 1.11.34. The reporter verified the issue on 1.11.32. Version 1.11.33 is not mentioned in the advisory's patched list, so move straight to 1.11.34 or later.
The advisory describes two parts that make the impact severe.
- An unauthenticated SQL injection through the custom_dates parameter, which lets a remote attacker run SQL commands against the application's database.
- A predictable legacy password reset mechanism. By chaining the two, the advisory says an attacker can reach full administrative account takeover without any credentials.
The advisory states that the whole database is exposed, including student personal data, teacher credentials, system configuration, and financial and course data. The weakness is CWE-89 (SQL Injection).
How to check if you're exposed
Find every Chamilo installation you run, including old or test copies, and read its version from the administration area or from the release files on the server. Anything at or below 1.11.32 is affected, and treat 1.11.33 as unconfirmed.
Then check exposure. A learning platform is usually public by design, so assume the vulnerable endpoint is reachable by anyone who can reach the site.
Finally, review web server logs for unusual requests carrying the custom_dates parameter, especially ones with long values or SQL syntax in them. The advisory gives no indicators, so this is a general check and absence of hits is not proof of safety.
What to do now
- Upgrade Chamilo to 1.11.34 or later, or migrate to the 2.0 line, after taking a full backup of files and database.
- If you cannot upgrade immediately, take the site offline or restrict access to known networks while you do.
- Review administrator accounts for unexpected additions, changed emails and changed passwords, and review the password reset history.
- Force password resets for administrators and teachers, and consider doing so for all users if you saw suspicious activity, since the database was in scope.
- Review database logs and application logs for signs of bulk reads, and follow your data breach process if personal data may have been exposed.
- Put a web application firewall rule or reverse proxy restriction in front of the site as a temporary layer, knowing it does not replace the fix.
Why it matters
SQL injection happens when user input is placed into a database query as code instead of data. The query then does what the input says, not what the programmer intended. It is among the oldest and best understood weaknesses, and the fix is equally old: parameterised queries and strict input handling.
Two things make this record worse than a plain injection. The first is that no login is needed. The second is the chain the advisory describes: a predictable legacy password reset lets the attacker turn database access into control of an administrator account. At that point the problem is no longer only data theft. An administrator on a learning platform can change content, accounts and settings.
The data at stake is also sensitive. Learning platforms hold records about students, which can include minors, along with staff credentials and payment related information. That raises the cost of an incident through legal and reporting duties, not only through the technical cleanup.
The record does not flag exploitation in the wild, and the CVE is not in CISA's Known Exploited Vulnerabilities catalog. Because the issue is unauthenticated and the platform is public by nature, treat the patch as urgent.
A scan of your own web application from the outside is a useful check after patching, and the demo below shows what a dynamic scan reports.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which versions are fixed?
1.11.34 and the 2.0 line, according to the advisory. Versions up to and including 1.11.32 are affected.
Is a password reset needed after patching?
The advisory describes account takeover through a predictable legacy reset, so resetting administrator passwords and checking for unexpected changes is sensible. Reset more widely if you saw suspicious activity.
Does this need a login?
No. The advisory describes the SQL injection as unauthenticated.
Sources
Last reviewed: 19 October 2026.
