Baha Doumi

4 exploits Active since Nov 2024
CVE-2024-30616 WRITEUP HIGH WRITEUP
Chamilo LMS 1.11.26 - Incorrect Access Control via Profile Endpoint
Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. Non-admin users can manipulate sensitive profiles information, posing a significant risk to data integrity.
CVSS 8.8
CVE-2024-30617 WRITEUP MEDIUM WRITEUP
Chamilo LMS 1.11.26 - Cross-Site Request Forgery in Social Wall Post
A Cross-Site Request Forgery (CSRF) vulnerability in Chamilo LMS 1.11.26 "/main/social/home.php," allows attackers to initiate a request that posts a fake post onto the user's social wall without their consent or knowledge.
CVSS 5.4
CVE-2024-30618 WRITEUP MEDIUM WRITEUP
Chamilo LMS 1.11.26 - Stored Cross-Site Scripting via Group Topics Content Parameter
A Stored Cross-Site Scripting (XSS) Vulnerability in Chamilo LMS 1.11.26 allows a remote attacker to execute arbitrary JavaScript in a web browser by including a malicious payload in the 'content' parameter of 'group_topics.php'.
CVSS 6.1
CVE-2024-30619 WRITEUP HIGH WRITEUP
Chamilo LMS Version 1.11.26 - Info Disclosure
Chamilo LMS Version 1.11.26 is vulnerable to Incorrect Access Control. A non-authenticated attacker can request the number of messages and the number of online users via "/main/inc/ajax/message.ajax.php?a=get_count_message" AND "/main/inc/ajax/online.ajax.php?a=get_users_online."
CVSS 7.5