CVE-2023-3368
CRITICAL EXPLOITED IN THE WILD NUCLEIChamilo LMS <= 1.11.20 - Command Injection
Title source: llmExploitation Summary
CVE-2023-3368 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). A Nuclei detection template is also available.
Description
Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960.
Nuclei Templates (1)
Chamilo LMS <= v1.11.20 Unauthenticated Command Injection
CRITICALVERIFIEDby dwisiswant0
Shodan:
http.component:"Chamilo" || http.component:"chamilo" || cpe:"cpe:2.3:a:chamilo:chamilo"
References (4)
Core 4
Core References
Issue Tracking, Vendor Advisory vendor-advisory
https://support.chamilo.org/projects/chamilo-18/wiki/security_issues#Issue-121-2023-07-05-Critical-impact-High-risk-Unauthenticated-Command-Injection-CVE-2023-3368
Exploit, Third Party Advisory third-party-advisory
https://starlabs.sg/advisories/23/23-3368/
Scores
CVSS v3
9.8
EPSS
0.6890
EPSS Percentile
99.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
VulnCheck KEV
2024-09-18
InTheWild.io
2024-09-18
CWE
CWE-78
Status
published
Products (1)
chamilo/chamilo
< 1.11.20
Published
Nov 28, 2023
Tracked Since
Feb 18, 2026