Description

Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature. It extracts a ZIP archive before checking its content, and once it has been extracted, does not check files in a recursive way. This means that by putting a .php file in a folder and then this folder in a ZIP archive, the server will accept this file without any checks. Because one can access this file from the website, it is remote code execution. This is related to a scorm imsmanifest.xml file, the import_package function, and extraction in $courseSysDir.$newDir.

Remediation

References

CVE-2019-13082

Related Vulnerabilities

MySQL CVE-2019-2535 Vulnerability (CVE-2019-2535)

WordPress Plugin GamiPress-The most flexible and powerful gamification for WordPress Cross-Site Request Forgery (2.5.0)

Oracle JRE Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2024-21147)

MediaWiki Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2023-45369)

WordPress Plugin Giveaway Boost PHP Object Injection (2.1.2)

Severity

Critical

Classification

CVE-2019-13082 CWE-434 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities