CVE-2023-4220
Chamilo LMS Unauthenticated Big Upload File Remote Code Execution
MEDIUM 6.1EPSS 76.1%
Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.
- Affected
- Chamilo
- CVSS v3.1 NVD
- 6.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS v3.1 STARLABS
- 8.1 HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 76.08% chance of exploitation in the next 30 days, 100th percentile
- Nuclei
- medium · CWE-434
- Published
- 2023-11-28
- Updated
- 2024-08-02
Proof-of-concept exploits (30)
- https://starlabs.sg/advisories/23/23-4220
- 0x00-null/Chamilo-CVE-2023-4220-RCE-Exploit1★ · 2024-09-03
- 0xDTC/Chamilo-LMS-CVE-2023-4220-Exploit0★ · 2025-01-07
- Al3xGD/CVE-2023-4220-Exploit0★ · 2024-07-15
- H4cking4All/CVE-2023-42200★ · 2024-11-02
- HO4XXX/cve-2023-4220-poc0★ · 2024-07-09
- LGenAgul/CVE-2023-4220-Proof-of-concept0★ · 2024-08-18
- N1ghtfallXxX/CVE-2023-42201★ · 2024-08-02
- Pr1or95/CVE-2023-4220-exploit1★ · 2024-12-05
- Rai2en/CVE-2023-4220-Chamilo-LMS5★ · 2026-02-09
- TanveerS1ngh/Chamilo-LMS-CVE-2023-4220-Exploit0★ · 2025-01-07
- VanishedPeople/CVE-2023-42200★ · 2024-09-23
- Ziad-Sakr/Chamilo-CVE-2023-4220-Exploit5★ · 2024-07-08
- bueno-armando/CVE-2023-4220-RCE1★ · 2024-10-23
- charchit-subedi/chamilo-lms-unauthenticated-rce-poc0★ · 2024-08-02
- charlesgargasson/CVE-2023-42201★ · 2024-07-11
- dollarboysushil/Chamilo-LMS-Unauthenticated-File-Upload-CVE-2023-42201★ · 2024-07-07
- gmh5225/CVE-2023-42200★ · 2024-07-29
- krishnan-tech/CVE-2023-4226-POC1★ · 2024-07-10
- m3m0o/chamilo-lms-unauthenticated-big-upload-rce-poc0★ · 2024-07-27
- nr4x4/CVE-2023-42200★ · 2024-07-12
- numaan911098/CVE-2023-42200★ · 2024-11-13
- oxapavan/CVE-2023-4220-HTB-PermX1★ · 2024-11-10
- thefizzyfish/CVE-2023-42202★ · 2024-10-03
- thefizzyfish/CVE-2023-4220_Chamilo_RCE2★ · 2024-10-03
- zora-beep/CVE-2023-42201★ · 2025-01-24
- Least-Significant-Bit/CVE-2023-42200★ · 2026-01-13
- RandyNin/CVE-2023-42200★ · 2026-04-09
- Sn0wBaall/CVE-2023-4220-PoC0★ · 2026-02-12
- SpeatX/ChamiloLMS-CVE-2023-42200★ · 2026-05-12
Nuclei templates (1)
Metasploit modules (1)
ExploitDB entries (1)
Security advisories
- https://support.chamilo.org/projects/chamilo-18/wiki/security_issues#Issue-130-2023-09-04…
- chamilo/chamilo-lms/commit/3b487a55076fb06f96809b790a35dcdd42f8ec49