Authenticated unrestricted file upload RCE in Chamilo LMS work.ajax.php

This repository provides a working exploit for CVE-2023-4226, a critical unrestricted file upload vulnerability in Chamilo LMS (<= 1.11.24). The exploit consists of a Python script (CVE-2023-4226.py), a PHP reverse shell payload (rce.php), and a README with usage instructions. The Python script automates the exploitation process: it prompts the user for the target URL, session cookie, and attacker's IP/port, modifies the PHP payload with the attacker's details, and uploads both the payload and a crafted .htaccess file to the vulnerable endpoint (/main/inc/ajax/work.ajax.php). Once uploaded, the attacker can access the web shell at /app/cache/rce.php, which will connect back to the attacker's listener, granting remote shell access. The exploit requires a valid session cookie for a learner user and is operational, providing a real reverse shell if successful. The repository is well-structured, with clear separation between the exploit logic (Python) and the payload (PHP), and includes comprehensive documentation in Spanish.

This repository contains a Python proof-of-concept exploit for CVE-2023-4220, targeting Chamilo LMS versions 1.11.24 and earlier. The exploit leverages an unrestricted file upload vulnerability in the big file upload functionality, specifically in the 'bigUpload.php' script. The main exploit script (CVE-2023-4226.py) allows an attacker to upload a malicious PHP file (either a webshell for arbitrary command execution or a reverse shell) to the target server without authentication. The script then accesses the uploaded file to execute commands or establish a reverse shell connection. The repository consists of two files: the exploit script and a README providing detailed usage instructions and vulnerability context. The exploit is operational, providing real remote code execution capabilities against vulnerable Chamilo LMS instances.