Chamilo LMS Unauthenticated Big Upload File Remote Code Execution
100Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actcvss 8.1epss 76%
da publicação à arma222 dias
Publicada no NVD28 de nov.
1ª PoC+222d
metasploit28 de nov.
VulnCheck+373d
probabilidade de exploração
76%top 1% das CVEs
exploração observada
simVulnCheck
59 exploit(s) público(s)
Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Chamilo · ChamiloPoCs públicas encontradas — 59
exploitdbwww.exploit-db.com/exploits/52083não verificadogithubgithub.com/Ziad-Sakr/Chamilo-CVE-2023-4220-Exploit★ 5githubgithub.com/Rai2en/CVE-2023-4220-Chamilo-LMS★ 5githubgithub.com/thefizzyfish/CVE-2023-4220_Chamilo_RCE★ 1githubgithub.com/dollarboysushil/Chamilo-LMS-Unauthenticated-File-Upload-CVE-2023-4220★ 1githubgithub.com/oxapavan/CVE-2023-4220-HTB-PermX★ 1githubgithub.com/zora-beep/CVE-2023-4220★ 1githubgithub.com/charlesgargasson/CVE-2023-4220★ 1githubgithub.com/Pr1or95/CVE-2023-4220-exploit★ 1githubgithub.com/N1ghtfallXxX/CVE-2023-4220★ 1githubgithub.com/bueno-armando/CVE-2023-4220-RCE★ 1githubgithub.com/0x00-null/Chamilo-CVE-2023-4220-RCE-Exploit★ 1githubgithub.com/RandyNin/CVE-2023-4220★ 0githubgithub.com/SpeatX/ChamiloLMS-CVE-2023-4220★ 0githubgithub.com/m3m0o/chamilo-lms-unauthenticated-big-upload-rce-poc★ 0githubgithub.com/H4cking4All/CVE-2023-4220★ 0githubgithub.com/numaan911098/CVE-2023-4220★ 0githubgithub.com/Least-Significant-Bit/CVE-2023-4220★ 0githubgithub.com/Sn0wBaall/CVE-2023-4220-PoC★ 0githubgithub.com/HO4XXX/cve-2023-4220-poc★ 0githubgithub.com/nr4x4/CVE-2023-4220★ 0githubgithub.com/Al3xGD/CVE-2023-4220-Exploit★ 0githubgithub.com/gmh5225/CVE-2023-4220★ 0githubgithub.com/charchit-subedi/chamilo-lms-unauthenticated-rce-poc★ 0githubgithub.com/LGenAgul/CVE-2023-4220-Proof-of-concept★ 0githubgithub.com/VanishedPeople/CVE-2023-4220★ 0githubgithub.com/qrxnz/CVE-2023-4220★ 0githubgithub.com/0xDTC/Chamilo-LMS-CVE-2023-4220-Exploit★ 0vulncheckvulncheck.com/xdb/9fe6dd27f44cnão verificadovulncheckvulncheck.com/xdb/463dc3c4df19não verificadovulncheckvulncheck.com/xdb/10ae6624b0dfnão verificadovulncheckvulncheck.com/xdb/9316b9d7e5bfnão verificadovulncheckvulncheck.com/xdb/00cdf7216db2não verificadovulncheckvulncheck.com/xdb/80e50f659827não verificadovulncheckvulncheck.com/xdb/344c5660e668não verificadovulncheckvulncheck.com/xdb/3602eeac2b52não verificadovulncheckvulncheck.com/xdb/2ecbe581c242não verificadovulncheckvulncheck.com/xdb/20c77fa9263dnão verificadovulncheckvulncheck.com/xdb/cd29f0fcca93não verificadovulncheckvulncheck.com/xdb/452fdfb79592não verificadovulncheckvulncheck.com/xdb/25efb2079caanão verificadovulncheckvulncheck.com/xdb/4c0606dd5ec9não verificadovulncheckvulncheck.com/xdb/cb759ddb54e4não verificadovulncheckvulncheck.com/xdb/6b78ca62a34cnão verificadovulncheckvulncheck.com/xdb/f69a1f008b0enão verificadovulncheckvulncheck.com/xdb/21e1dfc97c59não verificadovulncheckvulncheck.com/xdb/58994525cdd3não verificadovulncheckvulncheck.com/xdb/3b6cd44e17c6não verificadovulncheckvulncheck.com/xdb/bdc95ad9609bnão verificadovulncheckvulncheck.com/xdb/98271549c6eanão verificadovulncheckvulncheck.com/xdb/01cef89ac168não verificadovulncheckvulncheck.com/xdb/51dcc188c2d6não verificadovulncheckvulncheck.com/xdb/6f3b083d8a2anão verificadovulncheckvulncheck.com/xdb/2fbc4336feacnão verificadovulncheckvulncheck.com/xdb/dae666e719cdnão verificadovulncheckvulncheck.com/xdb/e34138da6c04não verificadovulncheckvulncheck.com/xdb/a40b98381b26não verificadovulncheckvulncheck.com/xdb/630f4cc835a9não verificadovulncheckvulncheck.com/xdb/bbbcb12a4a5bnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://github.com/chamilo/chamilo-lms/commit/3b487a55076fb06f96809b790a35dcdd42f8ec49https://starlabs.sg/advisories/23/23-4220https://support.chamilo.org/projects/chamilo-18/wiki/security_issues#Issue-130-2023-09-04-Critical-impact-High-risk-Unauthenticated-users-may-gain-XSS-and-unauthenticated-RCE-CVE-2023-4220