Detects error-based SQL injection in Chamilo LMS via the custom_dates filter property in the model.ajax.php jqGrid endpoint. The endpoint appends user-supplied JSON filter data directly into a SQL WHERE clause without sanitization, allowing unauthenticated database access.
Is your app exploitable through CVE-2026-28430?
Scan your domain free