CVE-2023-3368
Chamilo LMS Unauthenticated Command Injection
Summary
Chamilo LMS Unauthenticated Command Injection
Original description
The description as published by the source.
Command injection in /main/webservices/additional_webservices.php in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960.
References
- advisory github.com
- advisory nvd.nist.gov
- advisory starlabs.sg
- advisory support.chamilo.org
- patch github.com
- patch https
- web github.com