CVE-2023-4220

Description

Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.

References

https://github.com/SpeatX/ChamiloLMS-cve-2023-4220

https://github.com/insomnia-jacob/CVE-2023-4220

https://github.com/Sahil-Makhija/CVE-reports-from-Perplexity

https://github.com/zora-beep/CVE-2023-4220

https://github.com/MikeyPPPPPPPP/CVE-2023-4220

https://github.com/numaan911098/CVE-2023-4220

https://github.com/IvAlexEv/Exploit-CVE

https://github.com/TanveerS1ngh/Chamilo-LMS-CVE-2023-4220-Exploit

https://github.com/bueno-armando/CVE-2023-4220-RCE

https://github.com/qrxnz/CVE-2023-4220

https://github.com/thefizzyfish/CVE-2023-4220

https://github.com/LGenAgul/CVE-2023-4220-Proof-of-concept

https://github.com/Al3xGD/CVE-2023-4220-Exploit

https://github.com/nr4x4/CVE-2023-4220

https://github.com/krishnan-tech/CVE-2023-4226-POC

https://github.com/dollarboysushil/Chamilo-LMS-Unauthenticated-File-Upload-CVE-2023-4220

https://support.chamilo.org/projects/chamilo-18/wiki/security_issues#Issue-130-2023-09-04-Critical-impact-High-risk-Unauthenticated-users-may-gain-XSS-and-unauthenticated-RCE-CVE-2023-4220

https://starlabs.sg/advisories/23/23-4220

https://github.com/chamilo/chamilo-lms/commit/3b487a55076fb06f96809b790a35dcdd42f8ec49

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS