Description
Path traversal in file upload functionality in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write.
Remediation
References
Related Vulnerabilities
PHP Numeric Errors Vulnerability (CVE-2007-1001)
WordPress Plugin Simple Image Manipulator Arbitrary File Download (1.0)
WordPress Plugin Ninja Forms with File Uploads Extension Cross-Site Scripting (3.3.12)
WordPress Plugin WordPress Button Plugin MaxButtons Cross-Site Scripting (1.26.0)
WordPress Plugin Advanced Access Manager Multiple Vulnerabilities (6.6.1)