Loading vulnerability…
Command Injection in Chamilo LMS openoffice_presentation.class.php
CVE-2023-4221 is a command injection vulnerability in Chamilo LMS affecting versions up to and including 1.11.24. The flaw is in main/lp/openoffice_presentation.class.php and is reachable through the learning-path upload workflow in main/lp/lp_upload.php. In the vulnerable path, user-controlled slide_size input is split into slide_width and slide_height in OpenofficeDocument::convert_document() without type-casting or sanitization, and OpenofficePresentation::add_command_parameters() appends those values directly into an OS command. When Chamilo RAPID is enabled and the service_ppt2lp host is configured as localhost, the application executes the constructed command via exec(), allowing shell metacharacters in slide_size to trigger arbitrary command execution. The issue affects users with permission to upload Learning Paths, such as a Trainer-role user, and appears to be a variant of CVE-2023-34960.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in remote code execution in the security context of the Chamilo application on the target server. An authenticated attacker with learning-path upload privileges can execute arbitrary shell commands, which can lead to full compromise of confidentiality, integrity, and availability of the affected host and application data. The provided proof of concept demonstrates execution of the id command and creation of a server-side file (/tmp/rce), confirming arbitrary command execution capability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable or restrict the vulnerable learning-path conversion workflow. In particular, reduce access to Learning Path upload functionality to only strictly necessary trusted users, disable Chamilo RAPID if operationally feasible, and avoid configuring service_ppt2lp to localhost where this vulnerable local exec path is used. Monitor and review requests to /main/lp/lp_upload.php, /main/lp/lp_controller.php, /main/upload/upload_ppt.php, /main/upload/upload_upload.php, and /main/upload/upload.scorm.php, with emphasis on requests containing a non-empty ppt2lp parameter and suspicious slide_size values containing shell metacharacters.
Patch, then assume compromise.
Upgrade Chamilo LMS to version 1.11.26 or later, as Chamilo released a complete fix in v1.11.26 on 2023-09-27. The vulnerable command construction should be corrected by properly escaping shell arguments, for example with escapeshellarg(), and by avoiding direct inclusion of user-controlled values in OS command strings. Review adjacent upload and document-conversion code paths for similar command-construction flaws, especially variants related to CVE-2023-4222 and CVE-2023-34960.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.