CVE-2023-4220— Chamilo LMS 安全漏洞
一分钟漏洞结论
影响对象
Chamilo Chamilo
利用判断
存在公开或 AI PoC，应优先验证
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Chamilo LMS是Chamilo协会的一套开源的在线学习和协作系统。该系统支持创建教学内容、远程培训和在线答题等。 Chamilo LMS v1.11.24 版本及之前版本存在安全漏洞，该漏洞源于 “/main/inc/lib/javascript/bigupload/inc/bigUpload.php”页面存在大文件上传功能存在不受限制的文件上传。
公开利用映射 3
ExploitDB · 1
EDB-52083 [webapps]
Metasploit · 1
chamilo_bigupload_webshell.rb [exploit]
Nuclei · 1
CVE-2023-4220.yaml [template]
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2023-4220 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Chamilo LMS Unauthenticated Big Upload File Remote Code Execution
来源: CVE Program / CVE List V5
Vulnerability Description
Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
来源: CVE Program / CVE List V5
Vulnerability Title
Chamilo LMS 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Chamilo LMS是Chamilo协会的一套开源的在线学习和协作系统。该系统支持创建教学内容、远程培训和在线答题等。 Chamilo LMS v1.11.24 版本及之前版本存在安全漏洞，该漏洞源于 “/main/inc/lib/javascript/bigupload/inc/bigUpload.php”页面存在大文件上传功能存在不受限制的文件上传。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2023-4220 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | This is a script written in Python that allows the exploitation of the Chamilo's LMS software security flaw described in CVE-2023-4220 | https://github.com/m3m0o/chamilo-lms-unauthenticated-big-upload-rce-poc | POC详情 |
| 2 | Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell. | https://github.com/dollarboysushil/Chamilo-LMS-Unauthenticated-File-Upload-CVE-2023-4220 | POC详情 |
| 3 | https://starlabs.sg/advisories/23/23-4220/ | https://github.com/charlesgargasson/CVE-2023-4220 | POC详情 |
| 4 | CVE-2023-4220 POC RCE | https://github.com/insomnia-jacob/CVE-2023-4220- | POC详情 |
| 5 | This is an Exploit for Unrestricted file upload in big file upload functionality in Chamilo-LMS for this location "/main/inc/lib/javascript/bigupload/inc/bigUpload.php" in Chamilo LMS <= v1.11.24, and Attackers can obtain remote code execution via uploading of web shell. | https://github.com/Ziad-Sakr/Chamilo-LMS-CVE-2023-4220-Exploit | POC详情 |
| 6 | This is an Exploit for Unrestricted file upload in big file upload functionality in Chamilo-LMS for this location "/main/inc/lib/javascript/bigupload/inc/bigUpload.php" in Chamilo LMS <= v1.11.24, and Attackers can obtain remote code execution via uploading of web shell. | https://github.com/Ziad-Sakr/Chamilo-CVE-2023-4220-Exploit | POC详情 |
| 7 | PoC for CVE-2023-4220 - Chamilo LMS - Unauthenticated File Upload in BigUpload | https://github.com/HO4XXX/cve-2023-4220-poc | POC详情 |
| 8 | Proof of concept exploit for CVE-2023-4220 | https://github.com/B1TC0R3/CVE-2023-4220-PoC | POC详情 |
| 9 | CVE-2023–4220 Exploit | https://github.com/nr4x4/CVE-2023-4220 | POC详情 |
| 10 | LMS Chamilo 1.11.24 CVE-2023-4220 Exploit | https://github.com/Al3xGD/CVE-2023-4220-Exploit | POC详情 |
| 11 | CVE-2023-4220 POC RCE | https://github.com/insomnia-jacob/CVE-2023-4220 | POC详情 |
| 12 | This is a script written in Python that allows the exploitation of the Chamilo's LMS software security flaw described in CVE-2023-4220 | https://github.com/charchit-subedi/chamilo-lms-unauthenticated-rce-poc | POC详情 |
| 13 | Chamilo LMS Unauthenticated Big Upload File that allows remote code execution | https://github.com/LGenAgul/CVE-2023-4220-Proof-of-concept | POC详情 |
| 14 | None | https://github.com/VanishedPeople/CVE-2023-4220 | POC详情 |
| 15 | Python exploit for Chamilo Unrestricted File Upload Vuln - CVE-2023-4220 | https://github.com/thefizzyfish/CVE-2023-4220 | POC详情 |
| 16 | CVE-2023-4220 Chamilo Exploit | https://github.com/qrxnz/CVE-2023-4220 | POC详情 |
| 17 | (CVE-2023-4220) Chamilo LMS Unauthenticated Big Upload File Remote Code Execution | https://github.com/0x00-null/-Chamilo-CVE-2023-4220-RCE-Exploit | POC详情 |
| 18 | (CVE-2023-4220) Chamilo LMS Unauthenticated Big Upload File Remote Code Execution | https://github.com/0x00-null/Chamilo-CVE-2023-4220-RCE-Exploit | POC详情 |
| 19 | None | https://github.com/bueno-armando/CVE-2023-4220-RCE | POC详情 |
| 20 | Refurbish Chamilo LMS CVE-2023-4220 exploit written in bash | https://github.com/TanveerS1ngh/Chamilo-LMS-CVE-2023-4220-Exploit | POC详情 |
| 21 | CVE-2023-4220 Chamilo Exploit | https://github.com/H4cking4All/CVE-2023-4220 | POC详情 |
| 22 | Python exploit for Chamilo Unrestricted File Upload Vuln - CVE-2023-4220 | https://github.com/thefizzyfish/CVE-2023-4220_Chamilo_RCE | POC详情 |
| 23 | None | https://github.com/oxapavan/CVE-2023-4220-HTB-PermX | POC详情 |
| 24 | Refurbish Chamilo LMS CVE-2023-4220 exploit written in bash | https://github.com/0xDTC/Chamilo-LMS-CVE-2023-4220-Exploit | POC详情 |
| 25 | https://nvd.nist.gov/vuln/detail/CVE-2023-4220 | https://github.com/numaan911098/CVE-2023-4220 | POC详情 |
| 26 | Remote command execution exploit made for redteamers. | https://github.com/MikeyPPPPPPPP/CVE-2023-4220 | POC详情 |
| 27 | Carga de archivos sin restricciones en la funcionalidad de carga de archivos grandes en `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` en Chamilo LMS en versiones <= 1.11.24 permite a atacantes no autenticados realizar ataques de Cross Site Scripting almacenados y obtener código remoto ejecución mediante la carga de web shell. | https://github.com/Pr1or95/CVE-2023-4220-exploit | POC详情 |
| 28 | Exploit for CVE-2023-4220 | https://github.com/zora-beep/CVE-2023-4220 | POC详情 |
| 29 | Chamilo LMS Unauthenticated Remote Code Execution | https://github.com/N1ghtfallXxX/CVE-2023-4220 | POC详情 |
| 30 | CVE-2023-4220 POC RCE | https://github.com/gmh5225/CVE-2023-4220 | POC详情 |
AI 生成 POC
高级
Qwen3.6-35B-A3B
· 3940 chars
Pro+ 专属包含：
漏洞复现靶场录像（真实沙箱构建 + 触发，独家）
漏洞原理深度分析
触发条件与影响面
完整可执行 POC 代码
利用链与缓解建议
POC 打包下载
每月 100+ 条 AI 生成额度
三、漏洞 CVE-2023-4220 的情报信息
请登录查看更多情报信息。
CVE-2023-4220 补丁与修复 (1)
CVE-2023-4220 其他参考 (2)
-
https://starlabs.sg/advisories/23/23-4220 third-party-advisory
同批安全公告 · Chamilo · 2023-11-28 · 共 10 条
| CVE-2023-3545 | 9.8 CRITICAL | Chamilo LMS 安全漏洞 |
| CVE-2023-3533 | 9.8 CRITICAL | Chamilo LMS 安全漏洞 |
| CVE-2023-3368 | 9.8 CRITICAL | Chamilo LMS 安全漏洞 |
| CVE-2023-4225 | 8.8 HIGH | Chamilo LMS 安全漏洞 |
| CVE-2023-4226 | 8.8 HIGH | Chamilo LMS 安全漏洞 |
| CVE-2023-4224 | 8.8 HIGH | Chamilo LMS 安全漏洞 |
| CVE-2023-4223 | 8.8 HIGH | Chamilo LMS 安全漏洞 |
| CVE-2023-4222 | 7.2 HIGH | Chamilo LMS 安全漏洞 |
| CVE-2023-4221 | 7.2 HIGH | Chamilo LMS 安全漏洞 |