CVE-2023-34960 PoC — Chamilo 命令注入漏洞

Source

https://github.com/YongYe-Security/CVE-2023-34960

Associated Vulnerability

Title:Chamilo 命令注入漏洞 (CVE-2023-34960)
Description:Chamilo LMS是Chamilo协会的一套开源的在线学习和协作系统。该系统支持创建教学内容、远程培训和在线答题等。 Chamilo v1.11.0 到 v1.11.18版本存在安全漏洞，该漏洞源于wsConvertPpt 组件中的命令注入漏洞允许攻击者使用精心设计的 PowerPoint 名称通过 SOAP API 调用执行任意命令。

Description

Chamilo CVE-2023-34960 Batch scan/exploit

Readme

# Chamilo_CVE-2023-34960-EXP

帮助：

	usage: CVE-2023-34960.py [-h] [-u URL] [-f FILE] [-c COMMAND]

	options:
	  -h, --help            show this help message and exit
	  -u URL, --url URL     完整URL地址(http/https)
	  -f FILE, --file FILE  批量URL文件
	  -c COMMAND, --command COMMAND  执行命令,可选


示例：

	#单个url

	python3 CVE-2023-34960.py -u https://xxxxxxx

![image](https://github.com/YongYe-Security/Chamilo_CVE-2023-34960-EXP/assets/90460865/f7e0b158-5b13-4450-ac91-51a93b2fa0c0)


	#批量扫描
	python3 CVE-2023-34960.py -f url.txt
 ![image](https://github.com/YongYe-Security/Chamilo_CVE-2023-34960-EXP/assets/90460865/28cefd58-f067-4832-ab52-8134df9a2c33)

存在漏洞的扫描结果会存放在当前目录Kill_ALL.txt

微信公众号：YongYe 安全实验室


![yongye](https://github.com/YongYe-Security/Chamilo_CVE-2023-34960-EXP/assets/90460865/91eb1374-1631-476b-9213-71fec8219c95)

File Snapshot


 [4.0K]  /data/pocs/04a6189225804b0a35c887301fe771c2f64cd47b
├── [2.4K]  CVE-2023-34960.py
└── [ 934]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!