CVE-2023-4220

CVE-2023-4220 RCE Chamilo 1.11.24 | https://starlabs.sg/advisories/23/23-4220/ | | Chamilo LMS /tmp/rce.php EOF curl -F 'bigUploadFile=@/tmp/rce.php' "$HOST/$URLUPLD" CMD=$echo $CMD|base64 -w0| python3 -c "import urllib.parse,sys; printurllib.parse.quoteplussys.stdin.read" curl...

CVE-2023-4220-Chamilo-LMS

Chamilo LMS Unauthenticated Big Upload File RCE PoC This script allows the exploitation of the Chamilo's LMS software security flaw described in CVE-2023-4220. The system is vulnerable in versions preceding 1.11.24. Usage Clone the repository to your machine and install the dependencies using pip...

CVE-2023-4220-PoC

CVE-2023-4220 Arbitrary File Upload / RCE - PoC I created this script to automate the exploitation of CVE-2023-4220 and obtain a reverse shell on the Hack The Box PermX machine. This vulneraibilitie affects Chamilo LMS versions ≤ 1.11.24 , due to insufficient validation in the big upload...

chamilo-lms-unauthenticated-big-upload-rce-poc

Chamilo LMS Unauthenticated Big Upload File RCE PoC This is a script written in Python that allows the exploitation of the Chamilo's LMS software security flaw described in CVE-2023-4220. The system is vulnerable in versions preceding 1.11.24. Usage Clone the repository to your machine and instal...

CVE-2023-4220

CVE-2023-4220 Exploit Chamilo LMS Unauthenticated Big Upload File Remote Code Execution Usage cve-2023-4220.sh ./cve-2023-4220.sh ./cve-2023-4220.sh lms.test.htb 80 10.10.14.14 80 1 ./cve-2023-4220.sh -h Usage for RevShell: ./cve-2023-4220.sh Example: ./cve-2023-4220.sh lms.test.htb 80 10.10.14.1...

Exploit for Unrestricted Upload of File with Dangerous Type in Chamilo Chamilo_Lms

CVE-2023-4220 Chamilo LMS Unauthenticated Big Upload File Re...

Exploit for Unrestricted Upload of File with Dangerous Type in Chamilo Chamilo_Lms

Chamilo LMS Unauthenticated Big Upload File RCE PoC This is a...

PT-2023-28292 · Unknown · Chamilo Lms

Name of the Vulnerable Software and Affected Versions: Chamilo LMS versions prior to 1.11.24 Description: The issue allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell, specifically through the big file upload...