CVE-2019-13082: Malicious File Upload
Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lpupload.php unauthenticated file upload feature. It extracts a ZIP archive before checking its content, and once it has been extracted, does not check files in a recursive way. This means that by putting a .php file in a folder and then this folder in a ZIP archive, the server will accept this file without any checks. Because one can access this file from the website, it is remote code execution. This is related to a scorm imsmanifest.xml file, the importpackage function, and extraction in $courseSysDir.$newDir.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-13082?
CVE-2019-13082 refers to a vulnerability in Chamilo LMS 1.11.8 and 2.x that allows remote code execution through an unauthenticated file upload feature.
How can this vulnerability be exploited?
This vulnerability can be exploited by uploading a malicious PHP file through the lp_upload.php feature and then executing arbitrary code on the server.
What is the severity of CVE-2019-13082?
CVE-2019-13082 has a severity rating of critical with a CVSS score of 9.8.
Is there a fix available for CVE-2019-13082?
Yes, a fix is available for CVE-2019-13082. It is recommended to update to a version of Chamilo LMS that is not affected by this vulnerability.
Where can I find more information about CVE-2019-13082?
More information about CVE-2019-13082 can be found at the following references: [https://0xecute.com/?p=32](https://0xecute.com/?p=32) and [https://support.chamilo.org/projects/1/wiki/Security_issues](https://support.chamilo.org/projects/1/wiki/Security_issues).