PT-2026-32914

CVE-2026-33714

Published

2026-04-14

Updated

2026-04-15

Description by

CVSS 3.1

7.2

High

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo version 2.0.0-RC.2

Description An issue exists in the statistics AJAX endpoint where the date start and date end parameters in the users active action within the 'public/main/inc/ajax/statistics.ajax.php' file are not sanitized. These parameters are directly interpolated into a SQL query, allowing an authenticated admin to perform time-based blind SQL injection to extract arbitrary data from the database.

Recommendations Update to version 2.0.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Morimori-Dev

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers