## Summary
Chamilo chamilo-lms contains a stored XSS in the glossary feature. Users with the Teachers role can inject JavaScript that executes against the administrator. The issue is patched in 1.11.30.
## Technical Details
- Vulnerability type: Stored XSS (CWE-79) in the glossary function.
- Injection point: adding a glossary term allows JavaScript injection via the term parameter.
- Affected workflow: “adding a term in the glossary on a course created by the teacher”.
- Patch approach (from referenced commits):
- Input filtering improvements include applying an attribute-focused filter via applyFilter($name, 'attr_on_filter').
- HTML sanitization changes add a custom HTMLPurifier filter RemoveOnAttributes and use it in attr_on_filter(string $html) to remove dangerous on* attributes.
## Affected
- chamilo-lms versions: < 1.11.30
- Roles/conditions:
- Exploitation requires a user with the Teachers role.
- The glossary term is added in a course context created by the teacher.
- Note: the referenced advisory states the beta version also appears affected.
## Impact
- Stored XSS leading to administrator-targeted script execution.
- Likely consequences include compromise of confidentiality/integrity in the admin’s browser session (per NVD impact metrics).
## Mitigation
1. Upgrade chamilo-lms to 1.11.30 or later (patch is explicitly referenced).
2. If upgrade is not immediately possible, restrict or review Teacher role permissions and glossary term creation workflows until sanitization is applied.
3. Validate that the deployment includes the sanitization behavior equivalent to the RemoveOnAttributes/attr_on_filter changes.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
CWE-79