PT-2019-13117 · Chamilo · Chamilo Lms

Publicado 2019-06-30 · Atualizado 2019-07-03 · CVE-2019-13082

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions 1.11.8 and 2.x

Description The issue allows remote code execution through an unauthenticated file upload feature in lp upload.php. It extracts a ZIP archive before checking its content, and once extracted, does not check files in a recursive way. This enables an attacker to upload a .php file by placing it in a folder within a ZIP archive. The server accepts this file without checks, allowing access to it from the website and resulting in remote code execution. This is related to a scorm imsmanifest.xml file, the import package function, and extraction in $courseSysDir.$newDir.

Recommendations For Chamilo LMS version 1.11.8, consider disabling the lp upload.php file upload feature until a patch is available. For Chamilo LMS version 2.x, restrict access to the import package function to minimize the risk of exploitation.

Exploit

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-13082

Produtos afetados

Chamilo Lms

Referências · 6

• 🔥 https://0xecute.com/?p=32 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13082 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13082 · Nota
• https://osv.dev/vulnerability/CVE-2019-13082 · Aviso do Fabricante
• https://t.me/malwr/1547 · Publicação no Telegram
• https://support.chamilo.org/projects/1/wiki/Security_issues · Aviso do Fabricante