CVE-2023-4220 PoC — Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

Description

PoC for CVE-2023-4220 - Chamilo LMS - Unauthenticated File Upload in BigUpload

Readme

# CVE-2023-4220 Chamilio exploit PoC

~~Shamelessly Copied from~~ Directly inspired by: https://starlabs.sg/advisories/23/23-4220/

## Usage:

```

Chamilio CVE-2023-4220 POC Exploit

positional arguments:
  url         The Chamilio Url. e.g. http://example.com

options:
  -h, --help  show this help message and exit
  -c C        The command to execute. e.g. "id", default: id
  -f F        The filename to name the uploaded file. default: test.php
  -r          if set, will upload php revshell
  -i I        revshell attacker ip
  -p P        revshell attacker port

```

File Snapshot

Remarks