Description
A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.
Remediation
References
Related Vulnerabilities
WordPress Plugin Breezing Forms Cross-Site Scripting (1.2.7.33)
WordPress Plugin BuddyPress Multiple Vulnerabilities (9.0.0)
WordPress Plugin Disable Comments Cross-Site Request Forgery (1.0.3)
Apache HTTP Server Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-3185)
WordPress Plugin Travelpayouts:All Travel Brands in One Place Cross-Site Scripting (0.7.12)