Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2023-4220

Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

Published
Last modified
published
Not listed in CISA KEV
Fix
Fix or patch referenced
1 on Exploit-DB, 1 Metasploit module, 26 proofs of concept on GitHub, 1 Nuclei template

Summary

Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.

Timeline

  1. CVE published
  2. Record last updated
  3. Public exploit on Exploit-DB

    EDB-52083

  4. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • Chamilo Chamilo

    through 1.11.24

References 32

support.chamilo.org

starlabs.sg

GitHub · chamilo/chamilo-lms

Exploit-DB

GitHub · rapid7/metasploit-framework

GitHub · projectdiscovery/nuclei-templates

GitHub · 0x00-null/Chamilo-CVE-2023-4220-RCE-Exploit

GitHub · 0xDTC/Chamilo-LMS-CVE-2023-4220-Exploit

GitHub · Al3xGD/CVE-2023-4220-Exploit

GitHub · H4cking4All/CVE-2023-4220

GitHub · HO4XXX/cve-2023-4220-poc

GitHub · LGenAgul/CVE-2023-4220-Proof-of-concept

GitHub · Least-Significant-Bit/CVE-2023-4220

GitHub · N1ghtfallXxX/CVE-2023-4220

GitHub · Pr1or95/CVE-2023-4220-exploit

GitHub · Rai2en/CVE-2023-4220-Chamilo-LMS

GitHub · RandyNin/CVE-2023-4220

GitHub · Sn0wBaall/CVE-2023-4220-PoC

GitHub · SpeatX/ChamiloLMS-CVE-2023-4220

GitHub · VanishedPeople/CVE-2023-4220

GitHub · Ziad-Sakr/Chamilo-CVE-2023-4220-Exploit

GitHub · bueno-armando/CVE-2023-4220-RCE

GitHub · charchit-subedi/chamilo-lms-unauthenticated-rce-poc

GitHub · charlesgargasson/CVE-2023-4220

GitHub · dollarboysushil/Chamilo-LMS-Unauthenticated-File-Upload-CVE-2023-4220

GitHub · gmh5225/CVE-2023-4220

GitHub · m3m0o/chamilo-lms-unauthenticated-big-upload-rce-poc

GitHub · nr4x4/CVE-2023-4220

GitHub · numaan911098/CVE-2023-4220

GitHub · oxapavan/CVE-2023-4220-HTB-PermX

GitHub · thefizzyfish/CVE-2023-4220_Chamilo_RCE

GitHub · zora-beep/CVE-2023-4220