// For flags

CVE-2019-13082

 

Severity Score

9.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature. It extracts a ZIP archive before checking its content, and once it has been extracted, does not check files in a recursive way. This means that by putting a .php file in a folder and then this folder in a ZIP archive, the server will accept this file without any checks. Because one can access this file from the website, it is remote code execution. This is related to a scorm imsmanifest.xml file, the import_package function, and extraction in $courseSysDir.$newDir.

Chamilo LMS versiones 1.11.8 y 2.x, permite la ejecución de código remota por medio de una función de carga de archivos sin autenticar lp_upload.php. Extrae un archivo ZIP antes de comprobar su contenido, y una vez que haya sido extraído, no comprueba los archivos de manera recursiva. Esto significa que mediante la colocación de un archivo .php en una carpeta y luego esta carpeta en un archivo ZIP, el servidor aceptará este archivo sin ninguna comprobación. Debido a que se puede acceder a este archivo desde el sitio web, es una ejecución de código remota. Esto está relacionado con un archivo scorm imsmanifest.xml, la función import_package y la extracción en $courseSysDir.$newDir.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-06-30 CVE Reserved
  • 2019-06-30 CVE Published
  • 2024-08-04 CVE Updated
  • 2024-08-04 First Exploit
  • 2024-12-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-434: Unrestricted Upload of File with Dangerous Type
CAPEC
References (2)
URL Tag Source
URL Date SRC
https://0xecute.com/?p=32 2024-08-04
URL Date SRC
URL Date SRC
https://support.chamilo.org/projects/1/wiki/Security_issues 2019-07-03
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Chamilo
Search vendor "Chamilo"
 Chamilo Lms
Search vendor "Chamilo" for product "Chamilo Lms"
 1.11.8
Search vendor "Chamilo" for product "Chamilo Lms" and version "1.11.8"
-
Affected