{"id":"CVE-2023-34960","aliases":["EUVD-2023-38999","GHSA-p97h-9fxf-wpq6"],"status":"published","title":"A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18...","description":"A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.99325,"percentile":0.99938,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-77"],"published":"2023-08-01T00:00:00Z","modified":"2026-10-28T02:30:43Z","exploits":[{"source":"metasploit","id":"exploit/linux/http/chamilo_unauth_rce_cve_2023_34960","title":"Chamilo unauthenticated command injection in PowerPoint upload","type":"exploit","platform":"Linux,PHP,Unix","date":"2023-06-01","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/chamilo_unauth_rce_cve_2023_34960"},{"source":"nuclei","id":"CVE-2023-34960","title":"Chamilo Command Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34960.yaml"},{"source":"pocgithub","id":"Aituglo/CVE-2023-34960","title":"Aituglo/CVE-2023-34960","date":"2023-06-09","url":"https://github.com/Aituglo/CVE-2023-34960"},{"source":"pocgithub","id":"Ap0dexMe0/CVE-2023-34960","title":"Ap0dexMe0/CVE-2023-34960","date":"2023-07-22","url":"https://github.com/Ap0dexMe0/CVE-2023-34960"},{"source":"pocgithub","id":"Jenderal92/CHAMILO-CVE-2023-34960","title":"Jenderal92/CHAMILO-CVE-2023-34960","date":"2023-07-03","url":"https://github.com/Jenderal92/CHAMILO-CVE-2023-34960"},{"source":"pocgithub","id":"Mantodkaz/CVE-2023-34960","title":"Mantodkaz/CVE-2023-34960","date":"2023-07-24","url":"https://github.com/Mantodkaz/CVE-2023-34960"},{"source":"pocgithub","id":"YongYe-Security/CVE-2023-34960","title":"YongYe-Security/CVE-2023-34960","date":"2023-07-09","url":"https://github.com/YongYe-Security/CVE-2023-34960"},{"source":"pocgithub","id":"tpdlshdmlrkfmcla/cve-2023-34960","title":"tpdlshdmlrkfmcla/cve-2023-34960","date":"2025-03-30","url":"https://github.com/tpdlshdmlrkfmcla/cve-2023-34960"}],"products":[{"vendor":"chamilo","product":"chamilo"}],"references":[{"url":"https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-112-2023-04-20-Critical-impact-High-risk-Remote-Code-Execution","tags":["x_transferred","Issue Tracking","Vendor Advisory","web"]},{"url":"http://packetstormsecurity.com/files/174314/Chamilo-1.11.18-Command-Injection.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34960","tags":["advisory"]},{"url":"http://chamilo.com"},{"url":"https://github.com/advisories/GHSA-p97h-9fxf-wpq6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34960.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-34960","description":"A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.","status":"published","published":"2023-08-01T00:00:00Z","modified":"2026-07-09T00:26:26.801Z","updated_at":"2026-11-02T14:35:35.912488Z"}],"euvd":[{"id":"EUVD-2023-38999","description":"A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.","status":"published","published":"2023-08-01T00:00:00Z","modified":"2026-07-09T00:26:26Z","updated_at":"2026-11-02T18:20:06.275812Z"}],"ghsa":[{"id":"GHSA-p97h-9fxf-wpq6","title":"A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18...","description":"A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.","status":"published","published":"2023-08-01T03:31:17Z","modified":"2024-04-04T06:28:01Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:56:42.669106Z"}],"nvd":[{"id":"CVE-2023-34960","description":"A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.","status":"published","published":"2023-08-01T02:15:10.307Z","modified":"2026-07-09T01:18:27.567Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:08:18.687088Z"}],"osv":[{"id":"CVE-2023-34960","description":"A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.","status":"published","published":"2023-08-01T00:00:00Z","modified":"2026-10-28T02:30:43.087168072Z","updated_at":"2026-11-02T15:44:32.116263Z"}]}}