vanishedpeople/cve-2023-4220CVE-2023-4220 PoC Chamilo RCE
This repository contains a Proof of Concept (PoC) for CVE-2023-4220, a Remote Code Execution (RCE) vulnerability affecting Chamilo LMS. This vulnerability allows unauthenticated attackers to exploit a large file upload feature, leading to arbitrary code execution on the server.
[!IMPORTANT] This repository is intended for educational purposes and lawful research only. Use this code responsibly and only on systems you have permission to test. The author assumes no liability for any damages caused by misuse of the information provided.
A learning management system is a software application or web-based technology used to plan, implement and assess a specific learning process. It's used for e-learning practices and, in its most common form, consists of two elements: a server that performs the base functionality and a user interface (UI) that is operated by instructors, students and administrators.
Chamilo is an open-source PHP-based Learning Management System (LMS) that facilitates online education and training. It offers features such as course creation, content management, assessments, collaboration and delivering educational resources.
requests & argparse & time libraries[!NOTE] This PoC has been tested using python 3.11.9, requests 2.32.3 and chamilo 1.11
Clone the Repository:
Clone the repository and navigate into its directory.
git clone https://github.com/VanishedPeople/CVE-2023-4220.git
cd CVE-2023-4220
Install the dependencies:
pip install -r requirements.txt
Identify Target: Ensure you have the target Chamilo LMS instance that is vulnerable (affected version).
Run the Exploit: Execute the exploit script with the target's URL.
Upload Malicious Payload: The exploit script will upload a malicious file to the target Chamilo LMS instance by leveraging the big file upload feature.
Trigger Remote Code Execution: After the upload, the malicious file gets executed on the server, giving the attacker remote code execution capabilities.
Outcome: You should see a shell or the execution of commands on the server, depending on the payload and option used.
Check if the LMS is vulnerable
python3 main.py --url <URL> -m check
python3 main.py --url <URL> --mode webshell
Spawning a reverse shell
python3 main.py --url <URL> --mode revshell
To mitigate this vulnerability, ensure that the Chamilo LMS version is updated to the latest version where this issue is addressed. It is also recommended to implement strict validation and authentication for file uploads to avoid similar vulnerabilities.
This project is licensed under the Apache License 2.0 - see the LICENSE file for details.