Loading vulnerability…
Authenticated unrestricted file upload RCE in Chamilo LMS exercise.ajax.php
CVE-2023-4225 is an unrestricted file upload vulnerability in Chamilo LMS affecting versions up to and including 1.11.24. The flaw is present in /main/inc/ajax/exercise.ajax.php, where the upload functionality uses attacker-controlled filenames when constructing the destination path and does not adequately restrict dangerous file types. Uploaded content is written into SYS_ARCHIVE_PATH, which by default is the web-accessible /app/cache directory. Because that directory is writable by the web server and an attacker can overwrite or append to /app/cache/.htaccess, a learner-role user can enable execution of uploaded PHP content. Public reporting states that a proof of concept uploaded both a PHP web shell and a .htaccess file, then invoked the shell from /app/cache/rce.php/, achieving command execution as the web server user. The same flawed upload pattern is also noted in related Chamilo AJAX handlers, but CVE-2023-4225 specifically covers the exercise.ajax.php variant.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows authenticated remote code execution as the web server account, demonstrated as www-data. This can lead to full compromise of the Chamilo application, arbitrary command execution, access to application data, modification of course content or platform state, deployment of persistent web shells, and potential follow-on lateral movement depending on host configuration. The advisory also notes that the weakness can be used for stored cross-site scripting by uploading malicious HTML content if such files are not additionally blocked.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict or disable access to the vulnerable upload functionality in /main/inc/ajax/exercise.ajax.php, especially for low-privilege users. Prevent execution of scripts from /app/cache by enforcing web-server configuration that denies access or disables PHP execution there. Apply defensive .htaccess or equivalent server rules such as RedirectMatch 403 for sensitive file types and set X-Content-Type-Options: nosniff. Monitor server access logs for requests to /main/inc/ajax/exercise.ajax.php and /app/cache/*, and inspect /app/cache for unexpected PHP files or altered .htaccess content.
Patch, then assume compromise.
Upgrade Chamilo LMS to version 1.11.26 or later, which is identified as containing the complete fix. The advisory also recommends sanitizing user-supplied filenames before saving uploads, including use of functions such as api_replace_dangerous_char() and disable_dangerous_file(). Because the advisory notes that disable_dangerous_file() only blocks PHP and .htaccess files, it should also be enhanced to block HTML uploads to prevent stored XSS. Review and remove any malicious files from /app/cache, especially PHP files and modified .htaccess files.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.