sn0wbaall/cve-2023-4220-pocAutomated proof-of-concept exploit for CVE-2023-4220 in Chamilo LMS, enabling arbitrary file upload and remote code execution via unauthenticated access to the big upload functionality.
I created this script to automate the exploitation of CVE-2023-4220 and obtain a reverse shell on the Hack The Box PermX machine.
This vulneraibilitie affects Chamilo LMS versions ≤ 1.11.24, due to insufficient validation in the big upload funcionality. An unauthenticated attacker can upload files toa publicly accesible directory, which may lead to stored XSS or Remote code Excecution (RCE) if a malicious script in uploaded.
the vulerable endpoint is located in:
/main/inc/lib/javascript/bigupload/files/
When file names and types are not properly validated, uploaded files can be accessed directly through the web server.
