CVE-2023-3533
Chamilo LMS Unauthenticated Remote Code Execution via Arbitrary File Write
Summary
Chamilo LMS Unauthenticated Remote Code Execution via Arbitrary File Write
Original description
The description as published by the source.
Path traversal in file upload functionality in /main/webservices/additional_webservices.php in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write.
References
- advisory github.com
- advisory nvd.nist.gov
- advisory starlabs.sg
- advisory support.chamilo.org
- patch github.com
- web github.com