UpHeron
All vulnerabilities

Servers and applications

CVE-2013-6787

SQL injection vulnerability in the check_user_password function in main/auth/profile.php in Chamilo LMS 1.9.6 and earlier, when using the non-encrypted passwords mode set at installation, allows remote authenticated users to execute arbitrary SQL commands via the "password0" parameter.

Severity
Medium 6.0
Published
5 Dec 2013
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
2.7% in the next 30 daysHigher than 86% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
SQL injection (CWE-89)
Attack
Over the network · Needs a login
Attacker can
Read some data · Change some data · Slow it down
CVSS vector
AV:N/AC:M/Au:S/C:P/I:P/A:P
Sources
NVD

Affected software

SoftwareAffected versions
Chamilo LMSServers and applications · cpe:a:chamilo:chamilo_lms
  • Version 1.9.4
  • Version 1.9.2
  • Version 1.9.0
  • Version 1.8.8.6
All 10 release lines
  • Every version up to 1.9.6
  • Version 1.8.6.2
  • Version 1.8.7
  • Version 1.8.7.1
  • Version 1.8.8.2
  • Version 1.8.8.4
  • Version 1.8.8.6
  • Version 1.9.0
  • Version 1.9.2
  • Version 1.9.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2013-6787
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2013-6787