{"id":"CVE-2023-4220","aliases":["EUVD-2023-54093","GHSA-9wc2-3gq5-2f4c"],"status":"published","title":"Chamilo LMS Unauthenticated Big Upload File Remote Code Execution","description":"Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS \u003c= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.76084,"percentile":0.99535,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-434","CWE-79"],"published":"2023-11-28T07:11:47Z","modified":"2026-10-28T02:30:59Z","exploits":[{"source":"metasploit","id":"exploit/linux/http/chamilo_bigupload_webshell","title":"Chamilo v1.11.24 Unrestricted File Upload PHP Webshell","type":"exploit","platform":"PHP","date":"2023-11-28","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/chamilo_bigupload_webshell"},{"source":"pocgithub","id":"N1ghtfallXxX/CVE-2023-4220","title":"N1ghtfallXxX/CVE-2023-4220","date":"2024-07-07","url":"https://github.com/N1ghtfallXxX/CVE-2023-4220"},{"source":"pocgithub","id":"Rai2en/CVE-2023-4220-Chamilo-LMS","title":"Rai2en/CVE-2023-4220-Chamilo-LMS","date":"2024-07-07","url":"https://github.com/Rai2en/CVE-2023-4220-Chamilo-LMS"},{"source":"pocgithub","id":"charlesgargasson/CVE-2023-4220","title":"charlesgargasson/CVE-2023-4220","date":"2024-07-07","url":"https://github.com/charlesgargasson/CVE-2023-4220"},{"source":"pocgithub","id":"dollarboysushil/Chamilo-LMS-Unauthenticated-File-Upload-CVE-2023-4220","title":"dollarboysushil/Chamilo-LMS-Unauthenticated-File-Upload-CVE-2023-4220","date":"2024-07-07","url":"https://github.com/dollarboysushil/Chamilo-LMS-Unauthenticated-File-Upload-CVE-2023-4220"},{"source":"pocgithub","id":"m3m0o/chamilo-lms-unauthenticated-big-upload-rce-poc","title":"m3m0o/chamilo-lms-unauthenticated-big-upload-rce-poc","date":"2024-07-07","url":"https://github.com/m3m0o/chamilo-lms-unauthenticated-big-upload-rce-poc"},{"source":"pocgithub","id":"Ziad-Sakr/Chamilo-CVE-2023-4220-Exploit","title":"Ziad-Sakr/Chamilo-CVE-2023-4220-Exploit","date":"2024-07-08","url":"https://github.com/Ziad-Sakr/Chamilo-CVE-2023-4220-Exploit"},{"source":"pocgithub","id":"HO4XXX/cve-2023-4220-poc","title":"HO4XXX/cve-2023-4220-poc","date":"2024-07-09","url":"https://github.com/HO4XXX/cve-2023-4220-poc"},{"source":"pocgithub","id":"nr4x4/CVE-2023-4220","title":"nr4x4/CVE-2023-4220","date":"2024-07-11","url":"https://github.com/nr4x4/CVE-2023-4220"},{"source":"pocgithub","id":"Al3xGD/CVE-2023-4220-Exploit","title":"Al3xGD/CVE-2023-4220-Exploit","date":"2024-07-15","url":"https://github.com/Al3xGD/CVE-2023-4220-Exploit"},{"source":"pocgithub","id":"gmh5225/CVE-2023-4220","title":"gmh5225/CVE-2023-4220","date":"2024-07-29","url":"https://github.com/gmh5225/CVE-2023-4220"},{"source":"pocgithub","id":"charchit-subedi/chamilo-lms-unauthenticated-rce-poc","title":"charchit-subedi/chamilo-lms-unauthenticated-rce-poc","date":"2024-08-02","url":"https://github.com/charchit-subedi/chamilo-lms-unauthenticated-rce-poc"},{"source":"pocgithub","id":"LGenAgul/CVE-2023-4220-Proof-of-concept","title":"LGenAgul/CVE-2023-4220-Proof-of-concept","date":"2024-08-18","url":"https://github.com/LGenAgul/CVE-2023-4220-Proof-of-concept"},{"source":"pocgithub","id":"VanishedPeople/CVE-2023-4220","title":"VanishedPeople/CVE-2023-4220","date":"2024-08-24","url":"https://github.com/VanishedPeople/CVE-2023-4220"},{"source":"pocgithub","id":"thefizzyfish/CVE-2023-4220_Chamilo_RCE","title":"thefizzyfish/CVE-2023-4220_Chamilo_RCE","date":"2024-08-24","url":"https://github.com/thefizzyfish/CVE-2023-4220_Chamilo_RCE"},{"source":"pocgithub","id":"0x00-null/Chamilo-CVE-2023-4220-RCE-Exploit","title":"0x00-null/Chamilo-CVE-2023-4220-RCE-Exploit","date":"2024-09-03","url":"https://github.com/0x00-null/Chamilo-CVE-2023-4220-RCE-Exploit"},{"source":"pocgithub","id":"bueno-armando/CVE-2023-4220-RCE","title":"bueno-armando/CVE-2023-4220-RCE","date":"2024-10-23","url":"https://github.com/bueno-armando/CVE-2023-4220-RCE"},{"source":"pocgithub","id":"0xDTC/Chamilo-LMS-CVE-2023-4220-Exploit","title":"0xDTC/Chamilo-LMS-CVE-2023-4220-Exploit","date":"2024-10-27","url":"https://github.com/0xDTC/Chamilo-LMS-CVE-2023-4220-Exploit"},{"source":"pocgithub","id":"H4cking4All/CVE-2023-4220","title":"H4cking4All/CVE-2023-4220","date":"2024-11-02","url":"https://github.com/H4cking4All/CVE-2023-4220"},{"source":"pocgithub","id":"oxapavan/CVE-2023-4220-HTB-PermX","title":"oxapavan/CVE-2023-4220-HTB-PermX","date":"2024-11-10","url":"https://github.com/oxapavan/CVE-2023-4220-HTB-PermX"},{"source":"pocgithub","id":"numaan911098/CVE-2023-4220","title":"numaan911098/CVE-2023-4220","date":"2024-11-13","url":"https://github.com/numaan911098/CVE-2023-4220"},{"source":"pocgithub","id":"Pr1or95/CVE-2023-4220-exploit","title":"Pr1or95/CVE-2023-4220-exploit","date":"2024-12-05","url":"https://github.com/Pr1or95/CVE-2023-4220-exploit"},{"source":"pocgithub","id":"zora-beep/CVE-2023-4220","title":"zora-beep/CVE-2023-4220","date":"2025-01-24","url":"https://github.com/zora-beep/CVE-2023-4220"},{"source":"exploitdb","id":"EDB-52083","title":"Chamilo LMS 1.11.24 - Remote Code Execution (RCE)","type":"webapps","platform":"php","date":"2025-03-18","url":"https://www.exploit-db.com/exploits/52083"},{"source":"pocgithub","id":"Least-Significant-Bit/CVE-2023-4220","title":"Least-Significant-Bit/CVE-2023-4220","date":"2026-01-13","url":"https://github.com/Least-Significant-Bit/CVE-2023-4220"},{"source":"pocgithub","id":"Sn0wBaall/CVE-2023-4220-PoC","title":"Sn0wBaall/CVE-2023-4220-PoC","date":"2026-02-12","url":"https://github.com/Sn0wBaall/CVE-2023-4220-PoC"},{"source":"pocgithub","id":"RandyNin/CVE-2023-4220","title":"RandyNin/CVE-2023-4220","date":"2026-03-24","url":"https://github.com/RandyNin/CVE-2023-4220"},{"source":"nuclei","id":"CVE-2023-4220","title":"Chamilo LMS \u003c= 1.11.24 - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4220.yaml"}],"exploits_more":1,"products":[{"vendor":"chamilo","product":"chamilo"},{"vendor":"chamilo","product":"chamilo_lms"}],"references":[{"url":"https://support.chamilo.org/projects/chamilo-18/wiki/security_issues#Issue-130-2023-09-04-Critical-impact-High-risk-Unauthenticated-users-may-gain-XSS-and-unauthenticated-RCE-CVE-2023-4220","tags":["vendor-advisory","x_transferred","Issue Tracking","Vendor Advisory","advisory"]},{"url":"https://starlabs.sg/advisories/23/23-4220","tags":["third-party-advisory","x_transferred","Exploit","Third Party Advisory","advisory"]},{"url":"https://github.com/chamilo/chamilo-lms/commit/3b487a55076fb06f96809b790a35dcdd42f8ec49","tags":["patch","x_transferred","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4220","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9wc2-3gq5-2f4c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4220.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-4220","title":"Chamilo LMS Unauthenticated Big Upload File Remote Code Execution","description":"Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS \u003c= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.","status":"published","published":"2023-11-28T07:11:47.83Z","modified":"2024-08-02T07:17:12.155Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:35:30.116696Z"}],"euvd":[{"id":"EUVD-2023-54093","description":"Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS \u003c= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.","status":"published","published":"2023-11-28T07:11:47Z","modified":"2024-08-02T07:17:12Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:12.64889Z"}],"ghsa":[{"id":"GHSA-9wc2-3gq5-2f4c","title":"Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload...","description":"Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS \u003c= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.","status":"published","published":"2023-11-28T09:30:26Z","modified":"2023-11-28T09:30:27Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:55:06.860566Z"}],"nvd":[{"id":"CVE-2023-4220","description":"Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS \u003c= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.","status":"published","published":"2023-11-28T08:15:07.137Z","modified":"2026-06-17T06:37:20.767Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-434","CWE-79"],"updated_at":"2026-11-02T14:08:49.393375Z"}],"osv":[{"id":"CVE-2023-4220","title":"Chamilo LMS Unauthenticated Big Upload File Remote Code Execution","description":"Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS \u003c= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.","status":"published","published":"2023-11-28T07:11:47.83Z","modified":"2026-10-28T02:30:59.120463831Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:44:33.792101Z"}]}}