Loading vulnerability…
CVE-2023-34960 is a command injection vulnerability in Chamilo LMS v1.11.* through v1.11.18 affecting the wsConvertPpt functionality exposed via main/webservices/additional_webservices.php. According to the provided content, the flaw is reachable through a SOAP API call and is triggered by supplying a crafted PowerPoint name to the wsConvertPpt component. The vulnerability allows attacker-controlled input to be incorporated into an operating system command without proper sanitization, resulting in arbitrary command execution. The content also notes that later-disclosed Chamilo command injection issues, including CVE-2023-4221 and CVE-2023-4222, appear to be variants of this flaw and that this vulnerability has been exploited in the wild.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a proof-of-concept exploit for CVE-2023-34960, a vulnerability in Chamilo. The main file, poc.py, is a Python script that sends a crafted SOAP request to the /main/webservices/additional_webservices.php endpoint of a Chamilo instance. The exploit allows the user to check if a target is vulnerable and, if so, execute arbitrary system commands on the server by injecting them into the file_name parameter of the SOAP body. The repository consists of a README and the exploit script. The exploit is operational, as it provides a working payload and can execute attacker-supplied commands on a vulnerable target.
This repository provides an exploit for CVE-2023-34960, a command injection vulnerability in Chamilo LMS. The main exploit script is 'finder.py', a Python tool that automates the exploitation process. It reads a list of target URLs from a user-supplied file, then for each target, sends a crafted SOAP request to the '/main/webservices/additional_webservices.php' endpoint. The exploit injects a command via the 'file_name' parameter, causing the target to download and place a PHP web shell ('wso.php') from a remote GitHub repository. Successful exploitation is detected by parsing the SOAP response, and results are logged to 'resultVULN.txt'. The repository also includes a README with usage instructions, a requirements.txt for dependencies, and a placeholder text file. The exploit is operational, providing a working payload (web shell upload) and is intended for use against vulnerable Chamilo LMS installations.
This repository contains a Python 2.7 exploit script (CVE-2023-34960.py) targeting Chamilo e-learning platform's SOAP web service vulnerability (CVE-2023-34960). The exploit works by sending a specially crafted XML payload to the '/main/webservices/additional_webservices.php' endpoint, injecting a command that writes a base64-decoded PHP web shell ('shin.php') to the server. The script then attempts to access '/main/inc/lib/ppt2png/1.php' to verify if the shell was successfully uploaded. If successful, the attacker gains remote code execution via the web shell. The script supports multithreaded execution against a list of target URLs. The repository also includes a README.md with usage instructions and donation links. The exploit is operational, providing a working web shell payload, and is not part of any known exploit framework.
This repository contains a Python exploit for CVE-2023-34960, a mass unauthenticated command injection vulnerability in Chamilo LMS. The main file, 'exploit.py', is a command-line tool that allows the user to specify a target URL (or a file of URLs), a command to execute, and optional threading/output options. The exploit works by sending a crafted SOAP XML request to the '/main/webservices/additional_webservices.php' endpoint of the target Chamilo server, injecting the command into the 'file_name' parameter. The exploit is operational and allows for arbitrary command execution without authentication. The repository also includes a README.md with usage instructions and a requirements.txt listing dependencies. The exploit is cross-platform and can target both Linux and Windows Chamilo installations, provided the vulnerable endpoint is accessible. No hardcoded payload is present; the user supplies the command to execute, making this a flexible operational exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A recent vulnerability (details not specified in the content) that has been exploited by the Linuxsys miner campaign as part of n-day exploitation.
A vulnerability (details not specified in the content) exploited as part of the Linuxsys cryptominer campaign.
A command injection vulnerability in Chamilo LMS, exploited to deliver the Linuxsys miner.
A Chamilo N-day vulnerability referenced as having recent in-the-wild exploitation; no further technical details are provided in this content.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.