Filtered by vendor Chamilo
Subscribe
Search
Total
9 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-3533 | 1 Chamilo | 1 Chamilo | 2023-12-05 | N/A | 9.8 CRITICAL |
| Path traversal in file upload functionality in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write. | |||||
| CVE-2023-3368 | 1 Chamilo | 1 Chamilo | 2023-12-04 | N/A | 9.8 CRITICAL |
| Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960. | |||||
| CVE-2023-3545 | 1 Chamilo | 1 Chamilo | 2023-12-04 | N/A | 9.8 CRITICAL |
| Improper sanitisation in `main/inc/lib/fileUpload.lib.php` in Chamilo LMS <= v1.11.20 on Windows and Apache installations allows unauthenticated attackers to bypass file upload security protections and obtain remote code execution via uploading of `.htaccess` file. This vulnerability may be exploited by privileged attackers or chained with unauthenticated arbitrary file write vulnerabilities, such as CVE-2023-3533, to achieve remote code execution. | |||||
| CVE-2023-34960 | 1 Chamilo | 1 Chamilo | 2023-08-24 | N/A | 9.8 CRITICAL |
| A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name. | |||||
| CVE-2022-27423 | 1 Chamilo | 1 Chamilo Lms | 2022-04-25 | 7.5 HIGH | 9.8 CRITICAL |
| Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blog_id parameter at /blog/blog.php. | |||||
| CVE-2021-35414 | 1 Chamilo | 1 Chamilo Lms | 2021-12-06 | 7.5 HIGH | 9.8 CRITICAL |
| Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php. | |||||
| CVE-2021-34187 | 1 Chamilo | 1 Chamilo | 2021-07-01 | 7.5 HIGH | 9.8 CRITICAL |
| main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter. | |||||
| CVE-2018-1999019 | 1 Chamilo | 1 Chamilo Lms | 2019-09-17 | 7.5 HIGH | 9.8 CRITICAL |
| Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can result in Unauthenticated remote code execution. This attack appear to be exploitable via a simple GET request to the api endpoint. This vulnerability appears to have been fixed in After commit 0de84700648f098c1fbf6b807dee28ec640efe62. | |||||
| CVE-2019-13082 | 1 Chamilo | 1 Chamilo Lms | 2019-07-03 | 7.5 HIGH | 9.8 CRITICAL |
| Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature. It extracts a ZIP archive before checking its content, and once it has been extracted, does not check files in a recursive way. This means that by putting a .php file in a folder and then this folder in a ZIP archive, the server will accept this file without any checks. Because one can access this file from the website, it is remote code execution. This is related to a scorm imsmanifest.xml file, the import_package function, and extraction in $courseSysDir.$newDir. | |||||