Loading vulnerability…
Command Injection in Chamilo LMS openoffice_text_document.class.php
CVE-2023-4222 is a command injection vulnerability in Chamilo LMS affecting versions up to and including 1.11.24. The flaw is in main/lp/openoffice_text_document.class.php, where user-controlled input is incorporated into an OS command without proper neutralization. In the vulnerable flow, uploads handled through main/lp/lp_upload.php can be routed into the woogie processing path via a non-empty woogie POST parameter for non-dll and non-exe files. OpenofficeDocument::convert_document() derives $this->file_name from pathinfo($file['name'], PATHINFO_FILENAME), and OpenofficeTextDocument::add_command_parameters() uses that filename in a shell command without adequate sanitization. A crafted uploaded filename containing shell metacharacters can therefore trigger command injection and lead to remote code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated user with permission to upload Learning Paths to execute arbitrary OS commands on the Chamilo server in the context of the web application. This can result in full compromise of confidentiality, integrity, and availability, including access to sensitive data, modification of application content or server state, deployment of additional payloads, and service disruption.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable or restrict Learning Path upload functionality to trusted administrators only, disable Chamilo RAPID if operationally feasible, and avoid configurations where the service_ppt2lp option is set to localhost, since that condition is required for reliable exploitation. Monitor requests to /main/lp/lp_upload.php and related upload endpoints for non-empty woogie parameters and suspicious filenames containing shell metacharacters. Review database records and logs for anomalous Learning Path filenames, as uploaded filenames may be stored.
Patch, then assume compromise.
Upgrade Chamilo LMS to version 1.11.26 or later, as the vendor released a complete fix in 1.11.26 on 2023-09-27. Where shell execution is unavoidable, ensure all user-controlled values used in command construction are properly escaped, for example with escapeshellarg(), and review adjacent upload/conversion code paths for similar command-injection variants.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.