Loading vulnerability…
CVE-2023-4225 is an unrestricted file upload vulnerability in Chamilo LMS affecting versions up to and including 1.11.24. The flaw is present in /main/inc/ajax/exercise.ajax.php, where the upload functionality uses attacker-controlled filenames when constructing the destination path and does not adequately restrict dangerous file types. Uploaded content is written into SYS_ARCHIVE_PATH, which by default is the web-accessible /app/cache directory. Because that directory is writable by the web server and an attacker can overwrite or append to /app/cache/.htaccess, a learner-role user can enable execution of uploaded PHP content. Public reporting states that a proof of concept uploaded both a PHP web shell and a .htaccess file, then invoked the shell from /app/cache/rce.php/, achieving command execution as the web server user. The same flawed upload pattern is also noted in related Chamilo AJAX handlers, but CVE-2023-4225 specifically covers the exercise.ajax.php variant.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
www-data. This can lead to full compromise of the Chamilo application, arbitrary command execution, access to application data, modification of course content or platform state, deployment of persistent web shells, and potential follow-on lateral movement depending on host configuration. The advisory also notes that the weakness can be used for stored cross-site scripting by uploading malicious HTML content if such files are not additionally blocked.If you can’t patch tonight, do this now.
/main/inc/ajax/exercise.ajax.php, especially for low-privilege users. Prevent execution of scripts from /app/cache by enforcing web-server configuration that denies access or disables PHP execution there. Apply defensive .htaccess or equivalent server rules such as RedirectMatch 403 for sensitive file types and set X-Content-Type-Options: nosniff. Monitor server access logs for requests to /main/inc/ajax/exercise.ajax.php and /app/cache/*, and inspect /app/cache for unexpected PHP files or altered .htaccess content.Patch, then assume compromise.
api_replace_dangerous_char() and disable_dangerous_file(). Because the advisory notes that disable_dangerous_file() only blocks PHP and .htaccess files, it should also be enhanced to block HTML uploads to prevent stored XSS. Review and remove any malicious files from /app/cache, especially PHP files and modified .htaccess files.No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An unrestricted file upload vulnerability in Chamilo LMS /main/inc/ajax/exercise.ajax.php that allows an authenticated learner-role user to upload PHP files and achieve remote code execution by writing into the web-accessible cache directory and enabling PHP execution via .htaccess manipulation.
A related Chamilo file upload vulnerability referenced as one of three largely identical issues in similar AJAX upload handlers. Specific technical details are not provided in this content.
A related Chamilo file upload vulnerability referenced in the content, but not described in detail.
Referenced as one of three related Chamilo file upload vulnerabilities, but no specific technical details are provided in this content.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.