Chamilo LMS 2.0.0-RC.2 suffers from a SQL Injection vulnerability (CWE-89) in the statistics AJAX endpoint, specifically in the users_active action of public/main/inc/ajax/statistics.ajax.php. While a prior vulnerability (CVE-2026-30881) was partially fixed by sanitizing date_start and date_end parameters in one action, these parameters remain unsanitized in another action within the same file. An authenticated administrator can exploit this flaw to conduct time-based blind SQL injection, potentially extracting arbitrary database data. The vulnerability is fixed in Chamilo LMS version 2.0.0.

An authenticated administrator can exploit this vulnerability to perform time-based blind SQL injection, which may allow extraction of arbitrary data from the database. This could lead to unauthorized disclosure of sensitive information stored within the LMS database. The CVSS 4.0 base score is 7.1 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and significant impact on confidentiality and integrity.

Upgrade Chamilo LMS to version 2.0.0 or later, where this SQL Injection vulnerability has been fixed. There is no official patch or temporary fix available for versions prior to 2.0.0. Until the upgrade is applied, restrict administrative access to trusted users only to reduce risk.