Chamilo version 1.11.18 suffers from a PHP code injection vulnerability.