Description
Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.
Remediation
References
Related Vulnerabilities
Drupal Core 4.7.x Cross-Site Scripting (4.7.0 - 4.7.7)
Dolibarr Improper Authentication Vulnerability (CVE-2020-7995)
LimeSurvey CVE-2008-2570 Vulnerability (CVE-2008-2570)
Atlassian Jira Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-14998)
Squid Improper Privilege Management Vulnerability (CVE-2019-12522)