Published: 01/08/2023 Updated: 24/08/2023

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 0

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows malicious users to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.

Vulnerable Product	Search on Vulmon	Subscribe to Product
chamilo chamilo

This Metasploit module exploits an unauthenticated remote command execution vulnerability that affects Chamilo versions 11118 and below Due to a functionality called Chamilo Rapid to easily convert PowerPoint slides to courses on Chamilo, it is possible for an unauthenticated remote attacker to execute arbitrary commands at the OS level using a ...

Chamilo is an e-learning platform, also called Learning Management Systems (LMS) This module exploits an unauthenticated remote command execution vulnerability that affects Chamilo versions `11118` and below (CVE-2023-34960) Due to a functionality called Chamilo Rapid to easily convert PowerPoint slides t ...

Chamilo is an e-learning platform, also called Learning Management Systems (LMS). This module exploits an unauthenticated remote command execution vulnerability that affects Chamilo versions `1.11.18` and below (CVE-2023-34960). Due to a functionality called Chamilo Rapid to easily convert PowerPoint slides to courses on Chamilo, it is possible for an unauthenticated remote attacker to execute arbitrary commands at OS level using a malicious SOAP request at the vulnerable endpoint `/main/webservices/additional_webservices.php`.

msf > use exploit/linux/http/chamilo_unauth_rce_cve_2023_34960
msf exploit(chamilo_unauth_rce_cve_2023_34960) > show targets
    ...targets...
msf exploit(chamilo_unauth_rce_cve_2023_34960) > set TARGET < target-id >
msf exploit(chamilo_unauth_rce_cve_2023_34960) > show options
    ...show and set options...
msf exploit(chamilo_unauth_rce_cve_2023_34960) > exploit

Perform with Massive Command Injection (Chamilo)

CVE-2023-34960 Mass unauthenticated command injection (Chamilo) Screenshot Requirements Python37+ Supported Os Linuxer Wingays clone on replit Get start with $ git clone githubcom/tucommenceapousser/CVE-2023-34960-ex $ cd CVE-2023-34960-ex $ pip/pip3 install -r requirementstxt $ python/python3 exploitpy hunterhow for

CVE-2023-34960 Chamilo Command Injection with auto upload shell (use ur logic) check path directory at your result vuln, then you can find your access shells wsophp To Install & Execute $ git clone githubcom/Mantodkaz/CVE-2023-34960 $ cd CVE-2023-34960 $ pip install -r requirementstxt $ python3 finderpy Note fo

Chamilo_CVE-2023-34960-EXP 帮助： usage: CVE-2023-34960py [-h] [-u URL] [-f FILE] [-c COMMAND] options: -h, --help show this help message and exit -u URL, --url URL 完整URL地址(http/https) -f FILE, --file FILE 批量URL文件 -c COMMAND, --command COMMAND 执行命令,可选示例： #单个url python3

Perform with Massive Command Injection (Chamilo)

CVE-2023-34960 Mass unauthenticated command injection (Chamilo) Screenshot Requirements Python37+ Supported Os Linuxer Wingays Get start with $ git clone githubcom/Pari-Malam/CVE-2023-34960 $ cd CVE-2023-34960 $ pip/pip3 install -r requirementstxt $ python/python3 exploitpy Footprints Notes By using this tool, you agre

CVE-2023-34960 Chamilo PoC

CVE-2023-34960 CVE-2023-34960 Chamilo PoC

自己写的一些exp

exp-collect 自己写的一些exp 漏洞exp列表 Contec SolarView Compact 远程命令执行(CVE-2023-23333) Chamilo 命令执行漏洞 (cve-2023-34960) nginxwebui 命令执行漏洞 panabit-ixcache后台命令执行漏洞 sslvpn_client_rce (多厂商设备)RCE

Python 2.7

CHAMILO-CVE-2023-34960 Python 27 Buy Coffee : Bitcoin $: 31mtLHqhaXXyCMnT2EU73U8fwYwigiEEU1 Perfect Money $: U22270614 Saweria $: saweriaco/Shin403 Trakteer $: trakteerid/shin403 How To Use? Install Python 27 Download Here python filepy

Perform with Massive Command Injection (Chamilo)

CVE-2023-34960 Mass unauthenticated command injection (Chamilo) Screenshot Requirements Python37+ Supported Os Linuxer Wingays Get start with $ git clone githubcom/Pari-Malam/CVE-2023-34960 $ cd CVE-2023-34960 $ pip/pip3 install -r requirementstxt $ python/python3 exploitpy Footprints Notes By using this tool, you agre

CWE-77 http://chamilo.com https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-112-2023-04-20-Critical-impact-High-risk-Remote-Code-Execution http://packetstormsecurity.com/files/174314/Chamilo-1.11.18-Command-Injection.html https://nvd.nist.gov https://packetstormsecurity.com/files/174314/Chamilo-1.11.18-Command-Injection.html https://github.com/tucommenceapousser/CVE-2023-34960-ex

CVE-2023-34960

Vulnerability Summary

Vulnerability Trend

Exploits

Metasploit Modules

Github Repositories

References

Vulmon Search

About

Products

Connect