Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execute arbitrary code via a crafted plugin. This vulnerability is triggered through user interaction with the attacker's profile page.# CVE-2021-46398 Chamilo-LMS 1.11.14 RCE
Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execute arbitrary code via a crafted plugin. This vulnerability is triggered through user interaction with the attacker's profile page.
* One-Click Technique: An Attacker who has a student account can create a malicious web page or a malicious SVG image file and upload the file to the "My Productions" section of the student profile page, then he can copy the URL of that file and send it to the Chamilo Admin User. When the Admin user loads the file in his browser with an active chamilo session, in the background it will upload a plugin (.zip file) to chamilo. Then the attacker can simply navigate to /plugin/exploited-directory/ and execute malicious commands.
* "Zero Click" technique: In this case, the attacker abuses the "My Diplomas" feature and injects malicious javascript in it, and when the Admin visits the Attacker's (student) profile page or Portfolio, the malicious javascript gets executed and the malicious plugin gets uploaded to the server. After that, the attacker can simply navigate to /plugin/exploit/ directory and execute the shell.php script and execute arbitrary commands.
Advantages of this exploit: No need to upload a malicious file to /app/upload/users/ directory , No need to send a link or URL to the Admin. When the admin visits attacker's profile, the attacker gets the RCE ;-) .
https://user-images.githubusercontent.com/52229330/159543300-8ea0308b-b37b-4702-8e15-736173056ac7.mp4
[4.0K] /data/pocs/107e3f9a28cddc380c85e44140723b4f099f5bfc
├── [ 11M] chamilo_csrf-rce_exploit.mp4
├── [1.6K] README.md
└── [1.7K] zero-click.ht
0 directories, 3 files