Loading vulnerability…
CVE-2023-4224 is an unrestricted file upload vulnerability in Chamilo LMS affecting versions up to and including 1.11.24. The flaw is present in /main/inc/ajax/dropbox.ajax.php, where the upload chunking logic uses attacker-controlled filenames when constructing the destination path and does not adequately restrict dangerous file types. Uploaded content is written into SYS_ARCHIVE_PATH, which by default maps to the web-accessible /app/cache directory. Because that directory is writable by the web server and an attacker can upload a PHP payload and overwrite or append to /app/cache/.htaccess to permit PHP execution, an authenticated user with learner privileges can turn the upload primitive into remote code execution. The advisory also notes that the same weakness can enable stored cross-site scripting via uploaded HTML content.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
www-data. This can result in full compromise of application data handled by that account, arbitrary command execution, deployment of web shells, modification of application content, and potential follow-on lateral movement depending on host configuration. The flaw can also be abused for stored XSS by uploading malicious HTML content, creating additional risk to users who access the uploaded content.If you can’t patch tonight, do this now.
/main/inc/ajax/dropbox.ajax.php, especially for low-privilege users. Prevent execution of uploaded content from /app/cache by enforcing web server rules such as RedirectMatch 403 and X-Content-Type-Options: nosniff, and ensure PHP execution is disabled in that directory. Monitor server access logs for requests to /main/inc/ajax/dropbox.ajax.php and /app/cache/*, and inspect /app/cache for suspicious PHP files or altered .htaccess content. Also block HTML uploads to reduce stored XSS exposure.Patch, then assume compromise.
api_replace_dangerous_char() and disable_dangerous_file(), and enhancing disable_dangerous_file() in main/inc/lib/fileUpload.lib.php to also block HTML uploads. Review and remove any malicious files from /app/cache, including unauthorized PHP files and modified .htaccess files.No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as another related Chamilo file upload vulnerability advisory, but no specific technical details are provided in this content.
A related Chamilo file upload vulnerability referenced as one of three largely identical issues in similar AJAX upload handlers. Specific technical details are not provided in this content.
An unrestricted file upload vulnerability in Chamilo LMS /main/inc/ajax/dropbox.ajax.php that allows an authenticated learner-role attacker to upload PHP files and overwrite .htaccess in /app/cache, leading to remote code execution.
Referenced as one of three related Chamilo file upload vulnerabilities, but no specific technical details are provided in this content.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.