Description
Path traversal in file upload functionality in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write.
Remediation
References
Related Vulnerabilities
WordPress Plugin Yasr-Yet Another Stars Rating Unspecified Vulnerability (1.3.2)
MySQL CVE-2020-2806 Vulnerability (CVE-2020-2806)
Drupal Core 6.x Multiple Vulnerabilities (6.0 - 6.28)
WordPress Plugin Popup Maker-Popup for opt-ins, lead gen, & more Cross-Site Request Forgery (1.18.0)
WordPress Possible SQL Injection Vulnerability (0.70 - 3.6.1)