| Package | Affected versions | Patched versions |
|---|---|---|
| chamilo lms | < 1.11.34 | 1.11.34 |
Chamilo is a learning management system. Prior to version 1.11.34, a Cross-Site Request Forgery (CSRF) vulnerability allows an attacker to delete projects inside a course without the victim’s consent. The issue arises because sensitive actions such as project deletion do not implement anti-CSRF protections (tokens) and GET based requests. As a result, an authenticated user (Trainer) can be tricked into executing this unwanted action by simply visiting a malicious page. This issue has been patched in version 1.11.34.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free