🛠️ Exploitation CVE-2023-4226 for Chamilo LMS

📋 Description

Python script that automates the exploitation of CVE-2023-4226, an unrestricted file upload vulnerability in Chamilo LMS (<= v1.11.24). Uploads a PHP web shell based on PentesterMonkey and configures .htaccess to achieve a reverse shell. More details: STAR Labs Advisory.

🔍 Vulnerability

• Product: Chamilo LMS
• Severity: High (CVSS 3.1: 8.8)
• Affected Versions: <= v1.11.24
• Description: Users with the learner role can upload PHP files in /main/inc/ajax/work.ajax.php, achieving RCE.
• CWE: CWE-434 (Dangerous File Upload)

🚀 Functionality

1. Requests:
   • Target URL.
   • Session cookie (ch_sid).
   • Attacker's IP and port for the reverse shell.
2. Modifies rce.php with IP and port.
3. Executes:
   • GET to /main/work/work.php?cidReq=HW.
   • POST to /main/inc/ajax/work.ajax.php to upload rce.php and .htaccess.
4. Displays the web shell URL (/app/cache/rce.php).

📦 Requirements

• Python: requests, colorama.

  pip install requests colorama
  
  

• Files: rce.php (PentesterMonkey, included in the repository), .htaccess (generated by the script).

• Network: IP and port for the listener (e.g. nc -lvnp 4444).

🛠️ Usage

1. Clone the repository:

   git clone https://github.com/SkyW4r33x/CVE-2023-4226
   cd CVE-2023-4226    
   

2. Assign execution permissions to the script:

   chmod +x CVE-2023-4226.py    
   

3. Install dependencies:

   pip install requests colorama    
   

4. Start the listener in a terminal:

   nc -lvnp 4444    
   

5. Run the script:

   ./CVE-2023-4226.py    
   

6. Enter:

   • Chamilo URL.
   • Cookie ch_sid.
   • Listener IP and port.

7. Access the web shell to start the reverse shell:

   http://<chamilo>/app/cache/rce.php    
   

   Example: http://chamilo.local/app/cache/rce.php

🛡️ Mitigations

• Update to Chamilo >= v1.11.26.

• Sanitize file names.

• Block HTML in disable_dangerous_file().

• Add to .htaccess:

  RedirectMatch 403 ^/main/inc/lib/javascript/bigupload/files
  Header set X-Content-Type-Options nosniff    
  

⚠️ Legal Notice

Exclusive use for authorized testing. Unauthorized use is illegal.

🙌 Credits

• Vulnerability: Ngo Wei Lin (@Creastery), STAR Labs.
• Script: SkyW4r33x