Chamilo LMS Unauthenticated Big Upload File Remote Code Execution
100Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 8.1epss 76%
de la publicación al arma222 días
Publicada en NVD28 nov
1ª PoC+222d
metasploit28 nov
VulnCheck+373d
probabilidad de explotación
76%top 1% de las CVE
explotación observada
síVulnCheck
59 exploit(s) público(s)
Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Chamilo · ChamiloPoCs públicas encontradas — 59
exploitdbwww.exploit-db.com/exploits/52083no verificadogithubgithub.com/Rai2en/CVE-2023-4220-Chamilo-LMS★ 5githubgithub.com/Ziad-Sakr/Chamilo-CVE-2023-4220-Exploit★ 5githubgithub.com/oxapavan/CVE-2023-4220-HTB-PermX★ 1githubgithub.com/thefizzyfish/CVE-2023-4220_Chamilo_RCE★ 1githubgithub.com/0x00-null/Chamilo-CVE-2023-4220-RCE-Exploit★ 1githubgithub.com/bueno-armando/CVE-2023-4220-RCE★ 1githubgithub.com/N1ghtfallXxX/CVE-2023-4220★ 1githubgithub.com/dollarboysushil/Chamilo-LMS-Unauthenticated-File-Upload-CVE-2023-4220★ 1githubgithub.com/charlesgargasson/CVE-2023-4220★ 1githubgithub.com/Pr1or95/CVE-2023-4220-exploit★ 1githubgithub.com/zora-beep/CVE-2023-4220★ 1githubgithub.com/HO4XXX/cve-2023-4220-poc★ 0githubgithub.com/numaan911098/CVE-2023-4220★ 0githubgithub.com/m3m0o/chamilo-lms-unauthenticated-big-upload-rce-poc★ 0githubgithub.com/H4cking4All/CVE-2023-4220★ 0githubgithub.com/Least-Significant-Bit/CVE-2023-4220★ 0githubgithub.com/Sn0wBaall/CVE-2023-4220-PoC★ 0githubgithub.com/Al3xGD/CVE-2023-4220-Exploit★ 0githubgithub.com/charchit-subedi/chamilo-lms-unauthenticated-rce-poc★ 0githubgithub.com/nr4x4/CVE-2023-4220★ 0githubgithub.com/gmh5225/CVE-2023-4220★ 0githubgithub.com/LGenAgul/CVE-2023-4220-Proof-of-concept★ 0githubgithub.com/qrxnz/CVE-2023-4220★ 0githubgithub.com/VanishedPeople/CVE-2023-4220★ 0githubgithub.com/RandyNin/CVE-2023-4220★ 0githubgithub.com/0xDTC/Chamilo-LMS-CVE-2023-4220-Exploit★ 0githubgithub.com/SpeatX/ChamiloLMS-CVE-2023-4220★ 0vulncheckvulncheck.com/xdb/25efb2079caano verificadovulncheckvulncheck.com/xdb/4c0606dd5ec9no verificadovulncheckvulncheck.com/xdb/cb759ddb54e4no verificadovulncheckvulncheck.com/xdb/58994525cdd3no verificadovulncheckvulncheck.com/xdb/bdc95ad9609bno verificadovulncheckvulncheck.com/xdb/3b6cd44e17c6no verificadovulncheckvulncheck.com/xdb/98271549c6eano verificadovulncheckvulncheck.com/xdb/21e1dfc97c59no verificadovulncheckvulncheck.com/xdb/f69a1f008b0eno verificadovulncheckvulncheck.com/xdb/6b78ca62a34cno verificadovulncheckvulncheck.com/xdb/01cef89ac168no verificadovulncheckvulncheck.com/xdb/51dcc188c2d6no verificadovulncheckvulncheck.com/xdb/6f3b083d8a2ano verificadovulncheckvulncheck.com/xdb/2fbc4336feacno verificadovulncheckvulncheck.com/xdb/dae666e719cdno verificadovulncheckvulncheck.com/xdb/e34138da6c04no verificadovulncheckvulncheck.com/xdb/a40b98381b26no verificadovulncheckvulncheck.com/xdb/630f4cc835a9no verificadovulncheckvulncheck.com/xdb/bbbcb12a4a5bno verificadovulncheckvulncheck.com/xdb/9fe6dd27f44cno verificadovulncheckvulncheck.com/xdb/463dc3c4df19no verificadovulncheckvulncheck.com/xdb/10ae6624b0dfno verificadovulncheckvulncheck.com/xdb/9316b9d7e5bfno verificadovulncheckvulncheck.com/xdb/00cdf7216db2no verificadovulncheckvulncheck.com/xdb/80e50f659827no verificadovulncheckvulncheck.com/xdb/344c5660e668no verificadovulncheckvulncheck.com/xdb/3602eeac2b52no verificadovulncheckvulncheck.com/xdb/2ecbe581c242no verificadovulncheckvulncheck.com/xdb/20c77fa9263dno verificadovulncheckvulncheck.com/xdb/cd29f0fcca93no verificadovulncheckvulncheck.com/xdb/452fdfb79592no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://github.com/chamilo/chamilo-lms/commit/3b487a55076fb06f96809b790a35dcdd42f8ec49https://starlabs.sg/advisories/23/23-4220https://support.chamilo.org/projects/chamilo-18/wiki/security_issues#Issue-130-2023-09-04-Critical-impact-High-risk-Unauthenticated-users-may-gain-XSS-and-unauthenticated-RCE-CVE-2023-4220