CVE-2023-4226
Published: 28 November 2023
Summary
CVE-2023-4226 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Chamilo Chamilo Lms. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 3.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-4226 is an unrestricted file upload vulnerability in the `/main/inc/ajax/work.ajax.php` endpoint of Chamilo LMS versions up to and including 1.11.24. The flaw, tracked under CWE-434, permits authenticated users to upload arbitrary PHP files without sufficient validation or restrictions on file type or destination.
An attacker with a learner role can exploit the issue over the network to achieve remote code execution. Successful exploitation grants the ability to run arbitrary code on the server, resulting in full confidentiality, integrity, and availability impacts as reflected in the CVSS 8.8 score.
Public references point to official patches in the Chamilo repository and a vendor security advisory that address the issue through code changes in multiple commits. Administrators are advised to apply the updates or follow the mitigation guidance published by the Chamilo project.
The EPSS score has remained steady at its peak value of 0.2395 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-54099
Vulnerability details
Unrestricted file upload in `/main/inc/ajax/work.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.