Description
Command injection in `main/lp/openoffice_text_document.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters.
Remediation
References
Related Vulnerabilities
WordPress Plugin Flog Server-Side Request Forgery (1.0beta3)
Joomla! Core 1.5.x Security Bypass (1.5.0 - 1.5.14)
silverstripeCMS Improper Restriction of XML External Entity Reference Vulnerability (CVE-2020-25817)
WordPress Other Vulnerability (CVE-2007-3639)
WordPress Plugin BuddyPress Activity Plus Cross-Site Scripting (1.6.3)