Skip to content

Security: Fix SQL injection in LP progress save - refs GHSA-jfgr-ffv8-3865 - #9248

Merged
christianbeeznest merged 1 commit into
chamilo:1.11.xfrom
christianbeeznest:security/auto-fix-GHSA-jfgr-ffv8-3865
Oct 16, 2026
Merged

christianbeeznest merged 1 commit into
chamilo:1.11.xfrom
christianbeeznest:security/auto-fix-GHSA-jfgr-ffv8-3865

Conversation

@christianbeeznest

Copy link
Copy Markdown
Contributor

Fixes the SQL injection reported in GHSA-jfgr-ffv8-3865 in the learning path progress save flow.

The patch:

  • validates and normalizes score-related values;
  • stops trusting the client-provided LP view ID;
  • validates the LP item against the current learning path;
  • uses bound parameters for the vulnerable progress update.

No database changes are required.

@christianbeeznest
christianbeeznest merged commit 591572e into chamilo:1.11.x Oct 16, 2026
2 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant