CVE-2021-34187

CRITICAL EXPLOITED NUCLEI

Chamilo < 1.11.14 - Unauthenticated SQL Injection via Search Field or Filters Parameter

Title source: llm

CVE-2021-34187 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter.

Chamilo model.ajax.php - SQL Injection

CRITICALVERIFIEDby DhiyaneshDK

Shodan: X-Powered-By: Chamilo

FOFA: banner="X-Powered-By: Chamilo"

Core 4

Core References

Patch, Third Party Advisory x_refsource_misc

Patch, Third Party Advisory x_refsource_misc

Patch, Vendor Advisory x_refsource_misc

Exploit, Third Party Advisory x_refsource_misc

CVSS v3 9.8

EPSS 0.1558

EPSS Percentile 96.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulnCheck KEV 2023-12-02

CWE

CWE-89

Status published

Products (1)

chamilo/chamilo < 1.11.14

Published Jun 28, 2021

Tracked Since Feb 18, 2026