Chamilo LMS 2.0-RC.2 has a missing authentication vulnerability (CWE-306) in the public/main/inc/ajax/install.ajax.php file, which does not include the global authentication checks. The test_mailer action accepts an arbitrary Symfony Mailer DSN string from unauthenticated POST data, allowing attackers to connect to attacker-controlled SMTP servers. This enables SSRF attacks into internal networks via SMTP and allows the server to be used as an open email relay for phishing and spam. Error responses may leak internal network topology and service information. The vulnerability is addressed in version 2.0.0-RC.3.

An unauthenticated attacker can exploit this vulnerability to perform SSRF attacks targeting internal networks through the SMTP protocol, potentially bypassing network restrictions. The attacker can also use the vulnerable server as an open email relay, facilitating phishing and spam campaigns that appear to originate from the legitimate server IP. Additionally, error messages from failed SMTP connections may reveal sensitive information about internal network structure and running services. There is no indication of known exploits in the wild at this time.

Upgrade Chamilo LMS to version 2.0.0-RC.3 or later, where this vulnerability has been fixed. Since this is a self-hosted product, administrators should apply the official patch by updating to the fixed version. No other vendor-provided mitigations or temporary fixes are indicated. Patch status is confirmed by the vendor advisory stating the fix is included in version 2.0.0-RC.3.