CVE-2023-4224
Chamilo LMS File Upload Functionality Remote Code Execution
Summary
Chamilo LMS File Upload Functionality Remote Code Execution
Original description
The description as published by the source.
Unrestricted file upload in /main/inc/ajax/dropbox.ajax.php in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.
References
- advisory github.com
- advisory nvd.nist.gov
- advisory starlabs.sg
- advisory support.chamilo.org
- patch github.com
- patch github.com
- patch github.com