Vulnerability · Published Nov 28, 2023 · Assigned by STAR_Labs
CVE-2023-4220Chamilo LMS Unauthenticated Big Upload File Remote Code Execution
High 8.1
In plain English
A high-severity unrestricted file upload in Chamilo from Chamilo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 76.1% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code.
Official description
Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://support.chamilo.org/projects/chamilo-18/wiki/security_issues#Issue-130-2023-09-04-Critical-impact-High-risk-Unauthenticated-users-may-gain-XSS-and-unauthenticated-RCE-CVE-2023-4220 vendor-advisory
- https://starlabs.sg/advisories/23/23-4220 third-party-advisory
- https://github.com/chamilo/chamilo-lms/commit/3b487a55076fb06f96809b790a35dcdd42f8ec49 patch