CVE-2023-4220 Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS = v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell...

CVE-2023-4220

Summary (CVE-2023-4220, Chamilo LMS) Chamilo LMS

CVE-2023-4220 Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS = v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell...

CVE-2023-3545

CVE-2023-3545 affects Chamilo LMS ≤ v1.11.20 on Windows and Apache, due to improper sanitisation in main/inc/lib/fileUpload.lib.php. This allows unauthenticated attackers to bypass file upload protections and achieve remote code execution by uploading an .htaccess file. The exploit may be chained...

CVE-2023-3545 Chamilo LMS Htaccess File Upload Security Bypass

Improper sanitisation in main/inc/lib/fileUpload.lib.php in Chamilo LMS = v1.11.20 on Windows and Apache installations allows unauthenticated attackers to bypass file upload security protections and obtain remote code execution via uploading of .htaccess file. This vulnerability may be exploited ...

CVE-2023-3545 Chamilo LMS Htaccess File Upload Security Bypass

Improper sanitisation in main/inc/lib/fileUpload.lib.php in Chamilo LMS = v1.11.20 on Windows and Apache installations allows unauthenticated attackers to bypass file upload security protections and obtain remote code execution via uploading of .htaccess file. This vulnerability may be exploited ...

CVE-2023-3533 Chamilo LMS Unauthenticated Remote Code Execution via Arbitrary File Write

Path traversal in file upload functionality in /main/webservices/additionalwebservices.php in Chamilo LMS = v1.11.20 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write...

CVE-2023-3533

The CVE-2023-3533 entry concerns Chamilo LMS, specifically the path traversal flaw in the file-upload path /main/webservices/additional_webservices.php in Chamilo LMS

CVE-2023-3533 Chamilo LMS Unauthenticated Remote Code Execution via Arbitrary File Write

Path traversal in file upload functionality in /main/webservices/additionalwebservices.php in Chamilo LMS = v1.11.20 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write...

CVE-2023-3368 Chamilo LMS Unauthenticated Command Injection

Command injection in /main/webservices/additionalwebservices.php in Chamilo LMS = v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960...

CVE-2023-3368 Chamilo LMS Unauthenticated Command Injection

Command injection in /main/webservices/additionalwebservices.php in Chamilo LMS = v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960...

CVE-2023-3368

CVE-2023-3368 corresponds to an unauthenticated command injection in Chamilo LMS, exploited via the endpoint /main/webservices/additional_webservices.php. The public details state that Chamilo LMS

CVE-2023-3368 Chamilo LMS Unauthenticated Command Injection

Command injection in /main/webservices/additionalwebservices.php in Chamilo LMS = v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960...

Chamilo LMS Security Vulnerability

Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. The system supports the creation of instructional content, distance training, and online question and answer sessions. A security vulnerability exists in Chamilo LMS v1.11.20 and earlier versions,...

PT-2023-25204 · Unknown · Chamilo Lms

Name of the Vulnerable Software and Affected Versions: Chamilo LMS versions prior to 1.11.20 Description: The issue concerns a path traversal vulnerability in the file upload functionality, specifically in the /main/webservices/additional webservices.php endpoint. This allows unauthenticated...

PT-2023-28299 · Unknown · Chamilo Lms

Name of the Vulnerable Software and Affected Versions: Chamilo LMS versions prior to 1.11.24 Description: The issue concerns an unrestricted file upload in the /main/inc/ajax/exercise.ajax.php endpoint, allowing authenticated attackers with a learner role to achieve remote code execution by...

PT-2023-28298 · Unknown · Chamilo Lms

Name of the Vulnerable Software and Affected Versions: Chamilo LMS versions prior to 1.11.24 Description: The issue concerns an unrestricted file upload in the /main/inc/ajax/dropbox.ajax.php endpoint, allowing authenticated attackers with a learner role to achieve remote code execution by...

Chamilo LMS Security Vulnerability

Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. The system supports the creation of instructional content, distance training, and online question and answer sessions. A security vulnerability exists in Chamilo LMS v1.11.20 and earlier versions,...

Chamilo v1.11.24 Unrestricted File Upload PHP Webshell

Chamilo LMS is a free software e-learning and content management system. In versions prior to use exploit/linux/http/chamilo/biguploadwebshell msf undefinedbiguploadwebshell show actions ...actions... msf undefinedbiguploadwebshell set ACTION msf undefinedbiguploadwebshell show options ...show an...

PT-2023-28293 · Unknown · Chamilo Lms

Name of the Vulnerable Software and Affected Versions: Chamilo LMS versions prior to 1.11.24 Description: The issue concerns improper neutralisation of special characters, allowing command injection in the main/lp/openoffice presentation.class.php file. This enables users who are permitted to...