CVE-2025-59541

Executive Summary

CVE-2025-59541 is a Cross-Site Request Forgery (CSRF) vulnerability in Chamilo LMS, a widely used open-source learning management system. The flaw allows an authenticated attacker to trick a victim (a Trainer) into deleting projects within a course without their consent. The vulnerability exists because sensitive actions, such as project deletion, are performed via GET requests without any anti-CSRF token validation. This enables an attacker to craft a malicious page that, when visited by an authenticated user, triggers the deletion of a project. The CVSS score is 8.1 (High), indicating significant impact on data integrity and availability. The vulnerability is patched in Chamilo version 1.11.34.

Supply Chain & Package Security

Chamilo is a PHP-based application distributed as a complete package. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application logic. Organizations using Chamilo should treat this as a direct application security issue and prioritize patching.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack is carried out over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for the attack.
• Privileges Required (PR): None (N) - The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) - The victim must visit a malicious page.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): None (N) - No data is exposed.
• Integrity (I): High (H) - Project data can be deleted.
• Availability (A): High (H) - Project deletion impacts availability of course content.

Threat Level: High. The attack is easy to execute, requires minimal user interaction, and results in significant data loss.

Deep Dive & Mechanics

The vulnerability lies in the project deletion functionality within Chamilo. The application uses a GET request to delete a project, typically via a URL like: http://target.chamilo/main/project/delete.php?id=PROJECT_ID

This request does not include a CSRF token or any other form of validation to ensure the request originated from the legitimate user. An attacker can exploit this by crafting a malicious HTML page that automatically sends a GET request to the vulnerable endpoint when the victim visits it. For example, the attacker could embed an image tag or a script that triggers the deletion.

The attack flow:

1. The attacker identifies a target Chamilo instance and a specific project to delete.
2. The attacker creates a malicious page (e.g., exploit.html) containing an auto-submitting form or an image tag pointing to the deletion URL.
3. The attacker lures an authenticated Trainer to visit the malicious page (e.g., via phishing email or a compromised site).
4. The victim's browser sends the GET request to Chamilo, including the victim's session cookies.
5. Chamilo processes the request without CSRF validation, deleting the project.

Vulnerable vs. Patched Code

Vulnerable Code (GET-based, no CSRF token):

// main/project/delete.php (vulnerable)
<?php
require_once '../inc/global.inc.php';
api_protect_course_script(true);
$project_id = intval($_GET['id']);
$project = new Project($project_id);
if ($project->delete()) {
    // Success
}
?>

Patched Code (POST-based, with CSRF token):

// main/project/delete.php (patched)
<?php
require_once '../inc/global.inc.php';
api_protect_course_script(true);
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    die('Invalid request method.');
}
if (!Security::check_token('project_delete')) {
    die('CSRF token validation failed.');
}
$project_id = intval($_POST['id']);
$project = new Project($project_id);
if ($project->delete()) {
    Security::clear_token('project_delete');
    // Success
}
?>

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Install a vulnerable Chamilo version (e.g., 1.11.33) on a local server.
2. Create a course and a project within it.
3. Log in as a Trainer.

Exploitation Steps:

1. Craft a malicious HTML page that triggers the deletion:

<!DOCTYPE html>
<html>
<body>
<h1>Click to view your certificate</h1>
<img src="http://target.chamilo/main/project/delete.php?id=PROJECT_ID" style="display:none;">
</body>
</html>

2. Host this page on an attacker-controlled server.
3. Send the link to the victim (Trainer) via email or social engineering.
4. When the victim visits the page, the project is deleted.

Blue Team (Defender)

Detection Steps:

1. Monitor for GET requests to /main/project/delete.php with suspicious referrers.
2. Implement CSRF tokens for all state-changing operations.
3. Use Web Application Firewall (WAF) rules to block GET requests to delete endpoints.
4. Educate users about phishing attacks and the risks of clicking unknown links.

Indicators of Compromise (IOCs)

• Network IOCs:
  • GET requests to /main/project/delete.php?id=<number> with no CSRF token.
  • Referrer headers from external domains.
• Log IOCs:
  • Apache/Nginx access logs showing multiple GET requests to delete.php from the same IP.
  • Application logs showing project deletion events without corresponding POST data.
• File IOCs:
  • Presence of malicious HTML files on attacker servers containing auto-submitting forms or image tags.

Detection Engineering

YARA Rule

rule Detect_Chamilo_CSRF_Exploit {
    meta:
        description = "Detects malicious HTML pages attempting CSRF against Chamilo LMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-59541"
    strings:
        $s1 = "chamilo" nocase
        $s2 = "delete.php" nocase
        $s3 = "project" nocase
        $s4 = "src=" nocase
        $s5 = "action=" nocase
    condition:
        all of ($s1, $s2, $s3) and any of ($s4, $s5)
}

Sigma Rule

title: Chamilo LMS CSRF Project Deletion Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects GET requests to Chamilo project deletion endpoint without CSRF token
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/main/project/delete.php'
    condition: selection
falsepositives:
    - Legitimate GET requests from internal tools (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-59541 Chamilo LMS CSRF Project Deletion"; flow:to_server; http.method; content:"GET"; http.uri; content:"/main/project/delete.php"; nocase; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade Chamilo to version 1.11.34 or later.
2. Workaround: If patching is not possible, implement a WAF rule to block GET requests to /main/project/delete.php.
3. Code Fix: Ensure all state-changing operations use POST requests and include CSRF tokens.
4. User Training: Educate users about the risks of clicking suspicious links and the importance of verifying URLs.
5. Monitoring: Enable logging and monitoring for unusual access patterns to sensitive endpoints.

Report generated by Valters IT DevSecOps & CTI Division