CVE-2023-4220 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

🛡️ **CWE-434**: Unrestricted Upload of File with Dangerous Type. 🐛 **Flaw**: The endpoint `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` lacks validation. 🚫 No checks on file extensions or content types.

Q: Who is affected? (Versions/Components)

🏢 **Vendor**: Chamilo. 📦 **Product**: Chamilo LMS. 📅 **Affected**: Versions **≤ v1.11.24**. ⚠️ Any installation using the 'bigUpload' feature is at risk.

Q: Is exploitation threshold high? (Auth/Config)

📉 **Threshold**: **LOW**. 🔓 **Auth**: None required (Unauthenticated). ⚙️ **Config**: Default installation vulnerable. 🎯 Easy to exploit for anyone with network access.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔥 **Exploitation**: **YES**. 📜 **PoCs**: Multiple public Python/Ruby scripts available on GitHub. 🌍 **Wild Exploitation**: High risk due to simplicity of upload bypass. 🚀 Ready-to-use exploits exist.

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: **YES**. 🛠️ **Patch**: Update to version **> v1.11.24**. 📝 **Commit**: See Chamilo GitHub commit `3b487a5`. 🔄 Official vendor advisory confirms the fix.

Q: Is it urgent? (Priority Suggestion)

🔴 **Priority**: **CRITICAL**. 🚨 **Urgency**: **IMMEDIATE**. 📢 **Reason**: Unauthenticated RCE is a top-tier threat. 🏃 **Action**: Patch or mitigate within 24-48 hours.

Updated May 06, 2026 CVSS 8.1 · High

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Unrestricted file upload in Chamilo LMS. 📉 **Consequences**: Attackers can upload malicious files (web shells), leading to **Stored XSS** and full **Remote Code Execution (RCE)**.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **CWE-434**: Unrestricted Upload of File with Dangerous Type. 🐛 **Flaw**: The endpoint `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` lacks validation. 🚫 No checks on file extensions or content types.

Q3Who is affected? (Versions/Components)

🏢 **Vendor**: Chamilo. 📦 **Product**: Chamilo LMS. 📅 **Affected**: Versions **≤ v1.11.24**. ⚠️ Any installation using the 'bigUpload' feature is at risk.

Q4What can hackers do? (Privileges/Data)

🕵️ **Privileges**: **Unauthenticated** access required. 🗝️ **Impact**: Attackers gain **Remote Code Execution (RCE)**. 📂 They can upload web shells to `/main/inc/lib/javascript/bigupload/files/`.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

📉 **Threshold**: **LOW**. 🔓 **Auth**: None required (Unauthenticated). ⚙️ **Config**: Default installation vulnerable. 🎯 Easy to exploit for anyone with network access.

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔥 **Exploitation**: **YES**. 📜 **PoCs**: Multiple public Python/Ruby scripts available on GitHub. 🌍 **Wild Exploitation**: High risk due to simplicity of upload bypass. 🚀 Ready-to-use exploits exist.

Q7How to self-check? (Features/Scanning)

🔍 **Check**: Scan for `/main/inc/lib/javascript/bigupload/inc/bigUpload.php`. 🧪 **Test**: Attempt to upload a `.php` file via the big upload feature.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: **YES**. 🛠️ **Patch**: Update to version **> v1.11.24**. 📝 **Commit**: See Chamilo GitHub commit `3b487a5`. 🔄 Official vendor advisory confirms the fix.

Q9What if no patch? (Workaround)

🚧 **Workaround**: Disable or restrict access to the `bigUpload` module. 🚫 **Block**: Prevent uploads of executable scripts (`.php`, `.jsp`) via WAF rules.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔴 **Priority**: **CRITICAL**. 🚨 **Urgency**: **IMMEDIATE**. 📢 **Reason**: Unauthenticated RCE is a top-tier threat. 🏃 **Action**: Patch or mitigate within 24-48 hours.

Continue exploring

Vulnerability detail Full AI analysis (login) Chamilo CWE-434