PT-2019-13117 · Chamilo · Chamilo Lms

Published 2019-06-30 · Updated 2019-07-03 · CVE-2019-13082

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions 1.11.8 and 2.x

Description The issue allows remote code execution through an unauthenticated file upload feature in lp upload.php. It extracts a ZIP archive before checking its content, and once extracted, does not check files in a recursive way. This enables an attacker to upload a .php file by placing it in a folder within a ZIP archive. The server accepts this file without checks, allowing access to it from the website and resulting in remote code execution. This is related to a scorm imsmanifest.xml file, the import package function, and extraction in $courseSysDir.$newDir.

Recommendations For Chamilo LMS version 1.11.8, consider disabling the lp upload.php file upload feature until a patch is available. For Chamilo LMS version 2.x, restrict access to the import package function to minimize the risk of exploitation.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-13082

Affected Products

Chamilo Lms

References · 6

• 🔥 https://0xecute.com/?p=32 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13082 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13082 · Vendor Advisory
• https://support.chamilo.org/projects/1/wiki/Security_issues · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13082 · Note
• https://t.me/malwr/1547 · Telegram Post