Description
Unrestricted file upload in `/main/inc/ajax/dropbox.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.
Remediation
References
Related Vulnerabilities
Python Other Vulnerability (CVE-2006-1542)
Liferay Portal Incorrect Default Permissions Vulnerability (CVE-2021-33334)
MODX Improper Restriction of XML External Entity Reference Vulnerability (CVE-2020-25911)
e107 Credentials Management Errors Vulnerability (CVE-2013-7305)
Jenkins Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-0790)