Loading vulnerability…
CVE-2023-4226 is an unrestricted file upload vulnerability in Chamilo LMS affecting versions up to and including 1.11.24. The flaw is present in /main/inc/ajax/work.ajax.php, where the upload/chunking logic does not adequately restrict dangerous file types and uses attacker-controlled filenames when constructing the destination path. Uploaded files are written into SYS_ARCHIVE_PATH, which by default maps to the web-accessible /app/cache directory. Because that directory is writable by the web server and an attacker can upload a PHP payload and overwrite or append to .htaccess to permit PHP execution, an authenticated user with learner-role privileges can achieve remote code execution. The advisory also notes that the same weakness can enable stored cross-site scripting via uploaded HTML content if such files are not blocked.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
www-data. This gives an attacker the ability to run arbitrary commands on the target server and can lead to full compromise of the Chamilo instance, theft or modification of application data, deployment of web shells or other persistence mechanisms, and potential lateral movement depending on host configuration. The issue can also be abused for stored XSS through malicious uploaded content.If you can’t patch tonight, do this now.
/main/inc/ajax/work.ajax.php, especially for low-privilege users. Prevent execution of uploaded content from /app/cache by enforcing web-server rules such as denying direct access with RedirectMatch 403 and setting X-Content-Type-Options: nosniff, as recommended in the advisory. Block uploads of PHP, .htaccess, and HTML files, sanitize filenames, and monitor for requests to /main/inc/ajax/work.ajax.php and /app/cache/*. Inspect /app/cache for unexpected PHP files or altered .htaccess content.Patch, then assume compromise.
api_replace_dangerous_char() and disable_dangerous_file(). Because disable_dangerous_file() only blocks PHP and .htaccess files, the advisory also recommends enhancing main/inc/lib/fileUpload.lib.php to block HTML uploads as well. Review /app/cache for unauthorized PHP files or modified .htaccess files and inspect relevant access logs for exploitation attempts.2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository provides a working exploit for CVE-2023-4226, a critical unrestricted file upload vulnerability in Chamilo LMS (<= 1.11.24). The exploit consists of a Python script (CVE-2023-4226.py), a PHP reverse shell payload (rce.php), and a README with usage instructions. The Python script automates the exploitation process: it prompts the user for the target URL, session cookie, and attacker's IP/port, modifies the PHP payload with the attacker's details, and uploads both the payload and a crafted .htaccess file to the vulnerable endpoint (/main/inc/ajax/work.ajax.php). Once uploaded, the attacker can access the web shell at /app/cache/rce.php, which will connect back to the attacker's listener, granting remote shell access. The exploit requires a valid session cookie for a learner user and is operational, providing a real reverse shell if successful. The repository is well-structured, with clear separation between the exploit logic (Python) and the payload (PHP), and includes comprehensive documentation in Spanish.
This repository contains a Python proof-of-concept exploit for CVE-2023-4220, targeting Chamilo LMS versions 1.11.24 and earlier. The exploit leverages an unrestricted file upload vulnerability in the big file upload functionality, specifically in the 'bigUpload.php' script. The main exploit script (CVE-2023-4226.py) allows an attacker to upload a malicious PHP file (either a webshell for arbitrary command execution or a reverse shell) to the target server without authentication. The script then accesses the uploaded file to execute commands or establish a reverse shell connection. The repository consists of two files: the exploit script and a README providing detailed usage instructions and vulnerability context. The exploit is operational, providing real remote code execution capabilities against vulnerable Chamilo LMS instances.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as another related Chamilo file upload vulnerability advisory, but no specific technical details are provided in this content.
A related Chamilo file upload vulnerability referenced as one of three largely identical issues in similar AJAX upload handlers. Specific technical details are not provided in this content.
A related Chamilo file upload vulnerability referenced in the content, but not described in detail.
An unrestricted file upload vulnerability in Chamilo LMS /main/inc/ajax/work.ajax.php that allows an authenticated learner-role user to achieve remote code execution by uploading PHP files and modifying .htaccess in the writable app/cache directory.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.