3766 matches found
CVE-2023-4223
Technical details for CVE-2023-4223 are not present in the provided documents; related advisories discuss Chamilo file-upload issues but do not provide specifics for this CVE. Monitor for updates.
CVE-2023-4223 Chamilo LMS File Upload Functionality Remote Code Execution
Unrestricted file upload in /main/inc/ajax/document.ajax.php in Chamilo LMS = v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files...
CVE-2023-3533
Path traversal in file upload functionality in /main/webservices/additionalwebservices.php in Chamilo LMS = v1.11.20 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write...
CVE-2023-3368
Command injection in /main/webservices/additionalwebservices.php in Chamilo LMS = v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960...
CVE-2023-4222 Chamilo LMS Learning Path PPT2LP Command Injection Vulnerability
Command injection in main/lp/openofficetextdocument.class.php in Chamilo LMS = v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters...
CVE-2023-4222
CVE-2023-4222 concerns Chamilo LMS versions
CVE-2023-4222 Chamilo LMS Learning Path PPT2LP Command Injection Vulnerability
Command injection in main/lp/openofficetextdocument.class.php in Chamilo LMS = v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters...
Command injection
Command injection in /main/webservices/additionalwebservices.php in Chamilo LMS = v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960...
Design/Logic Flaw
Improper sanitisation in main/inc/lib/fileUpload.lib.php in Chamilo LMS = v1.11.20 on Windows and Apache installations allows unauthenticated attackers to bypass file upload security protections and obtain remote code execution via uploading of .htaccess file. This vulnerability may be exploited ...
Path traversal
Path traversal in file upload functionality in /main/webservices/additionalwebservices.php in Chamilo LMS = v1.11.20 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write...
CVE-2023-4221 Chamilo LMS Learning Path PPT2LP Command Injection Vulnerability
Command injection in main/lp/openofficepresentation.class.php in Chamilo LMS = v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters...
CVE-2023-4221
Summary: CVE-2023-4221/4222 affect Chamilo LMS up to version 1.11.24. Technical details in connected docs show command injection vulnerabilities in specific PHP classes used for Learning Paths uploads: main/lp/openoffice_presentation.class.php (CVE-2023-4221) and main/lp/openoffice_text_document....
CVE-2023-4221 Chamilo LMS Learning Path PPT2LP Command Injection Vulnerability
Command injection in main/lp/openofficepresentation.class.php in Chamilo LMS = v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters...
CVE-2023-4220 Chamilo LMS Unauthenticated Big Upload File Remote Code Execution
Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS = v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell...
CVE-2023-4220 Chamilo LMS Unauthenticated Big Upload File Remote Code Execution
Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS = v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell...
CVE-2023-4220
Summary (CVE-2023-4220, Chamilo LMS) Chamilo LMS
CVE-2023-3545
CVE-2023-3545 affects Chamilo LMS ≤ v1.11.20 on Windows and Apache, due to improper sanitisation in main/inc/lib/fileUpload.lib.php. This allows unauthenticated attackers to bypass file upload protections and achieve remote code execution by uploading an .htaccess file. The exploit may be chained...
CVE-2023-3545 Chamilo LMS Htaccess File Upload Security Bypass
Improper sanitisation in main/inc/lib/fileUpload.lib.php in Chamilo LMS = v1.11.20 on Windows and Apache installations allows unauthenticated attackers to bypass file upload security protections and obtain remote code execution via uploading of .htaccess file. This vulnerability may be exploited ...
CVE-2023-3545 Chamilo LMS Htaccess File Upload Security Bypass
Improper sanitisation in main/inc/lib/fileUpload.lib.php in Chamilo LMS = v1.11.20 on Windows and Apache installations allows unauthenticated attackers to bypass file upload security protections and obtain remote code execution via uploading of .htaccess file. This vulnerability may be exploited ...