🧠 Vulnerability Details

Affected Endpoint

Vulnerable File: main/inc/ajax/document.ajax.php
Vulnerable Function: ck_uploadimage

Root Cause Analysis

The upload handler performs only MIME-type validation using PHP's mime_content_type() function, which inspects the file's magic bytes (first few bytes of content), not the file extension.

Two separate weaknesses combine into a full exploitation chain:

1. MIME-type only validation — bypassed by prepending valid image magic bytes (GIF89a) to PHP code
2. Original filename preserved — the server stores the file using the attacker-controlled filename including the .php extension, in a web-accessible directory

Bypass Technique

A malicious file is crafted as follows:

• mime_content_type() reads GIF89a → classifies as image/gif → passes validation
• move_uploaded_file() saves as shell.php in /app/upload/users/<id>/ → directly executable via browser

💣 Proof of Concept

Run full exploit that log in as student to perform file upload automatically After running python full exploit, we can find our uploaded web shell at http://localhost:8081/app/upload/users/3/3/my_fileszhxoxgwj.php?cmd=id

🛡️ Impact

Successful exploitation of this vulnerability results in full server compromise from a student-level account:

• 🔴 Remote Code Execution — arbitrary OS commands via web shell
• 🔴 Data Exfiltration — full access to application database credentials and files
• 🔴 Lateral Movement — pivot to internal network from compromised server
• 🔴 Persistence — ability to plant backdoors in web-accessible directories
• 🔴 Service Disruption — modification or deletion of course content and user data

CIA Impact: Complete loss of Confidentiality, Integrity, and Availability.

🔧 Remediation

▪ Enforce strict file extension allowlisting Only explicitly permitted image file extensions (e.g., .jpg, .png, .gif) should be accepted. Uploaded files with executable extensions such as .php, .phtml, or .phar must be rejected regardless of MIME type.

▪ Do not rely solely on MIME-type validation MIME-type checks using functions such as mime_content_type() should not be used as the primary security control, as they can be bypassed using crafted file headers. MIME validation should only be used as a secondary check.

▪ Store uploaded files outside of web-accessible directories Uploaded content should be stored in a directory that is not directly accessible via the web server. If public access is required, files should be served through a controlled handler rather than direct access.

📄 References

• Chamilo LMS Official Site
• CWE-434: Unrestricted Upload of File with Dangerous Type
• OWASP: Unrestricted File Upload
• CVSS v3.1 Calculator

👤 Author

MENG HOKSENG
Independent Security Researcher

⚠️ Legal Disclaimer

This project is released for educational and authorized security research purposes only. The author is not responsible for any misuse or damage caused by this exploit. Always obtain explicit written authorization before performing security assessments.