Hello.
The vendor released a new working patch which fixes this issue. It is available as chameleon cms "build 2085/17".

Regards,

David Vieira-Kurz
(Security Researcher, majorsecurity.de)