Loading vulnerability…
CVE-2023-4223 is an unrestricted file upload vulnerability in Chamilo LMS affecting versions up to and including 1.11.24. The flaw is present in /main/inc/ajax/document.ajax.php, where the upload chunking implementation writes attacker-supplied files into SYS_ARCHIVE_PATH (defaulting to /app/cache) using user-controlled filenames without adequate validation or restriction of dangerous file types. Because /app/cache is writable by the web server and an attacker can overwrite or append to the existing .htaccess file there, an authenticated user with learner-role privileges can upload a PHP payload and enable its execution via the web server. Public reporting also notes that the same flawed upload pattern exists in related Chamilo AJAX handlers. In addition to PHP-based code execution, the issue can also be abused for stored cross-site scripting via uploaded malicious content such as HTML files.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
www-data. This gives an attacker the ability to run arbitrary commands on the target server, modify application data, access sensitive files available to the web server account, establish persistence through web shells, and potentially pivot further depending on host configuration. The vulnerability can also enable stored XSS through malicious uploaded content, creating additional risk to users of the platform.If you can’t patch tonight, do this now.
/main/inc/ajax/document.ajax.php, especially for low-privilege users. Prevent execution of uploaded content from /app/cache by enforcing web-server rules such as RedirectMatch 403 and X-Content-Type-Options: nosniff, and ensure .htaccess in that directory cannot be overwritten by application uploads. Monitor and inspect /app/cache for unexpected PHP files, HTML files, or modified .htaccess content, and review access logs for requests to /main/inc/ajax/document.ajax.php and /app/cache/*.Patch, then assume compromise.
api_replace_dangerous_char() and disable_dangerous_file(), and further recommends enhancing disable_dangerous_file() in main/inc/lib/fileUpload.lib.php to also block HTML uploads, not just PHP and .htaccess files.No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as another related Chamilo file upload vulnerability advisory, but no specific technical details are provided in this content.
An unrestricted file upload vulnerability in Chamilo LMS /main/inc/ajax/document.ajax.php that allows an authenticated learner-role attacker to upload PHP files and achieve remote code execution by overwriting .htaccess protections in the web-accessible cache directory.
A related Chamilo file upload vulnerability referenced in the content, but not described in detail.
Referenced as one of three related Chamilo file upload vulnerabilities, but no specific technical details are provided in this content.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.