CVE-2021-31933
HIGHChamilo <= 1.11.14 - Authenticated Remote Code Execution via File Upload Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2021-31933. PoCs published by M. Cory Billington.
AI-analyzed exploit summary This exploit leverages an authenticated file upload vulnerability in Chamilo LMS 1.11.14 to achieve remote code execution by uploading a malicious PHAR file to a writable directory. The exploit requires admin credentials and performs a directory traversal to place the webshell in a specific path.
Description
A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filtering for certain filenames (e.g., .phar or .pht). A remote authenticated administrator is able to upload a file containing arbitrary PHP code into specific directories via main/inc/lib/fileUpload.lib.php directory traversal to achieve PHP code execution.
Exploits (1)
This exploit leverages an authenticated file upload vulnerability in Chamilo LMS 1.11.14 to achieve remote code execution by uploading a malicious PHAR file to a writable directory. The exploit requires admin credentials and performs a directory traversal to place the webshell in a specific path.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H