Unauthenticated Command Injection in Chamilo wsConvertPpt SOAP API

This repository is a small standalone Python exploit for CVE-2023-34960, targeting Chamilo via an unauthenticated command injection in the SOAP-accessible additional webservices component. The repository contains three files: a README with usage notes, requirements.txt listing argparse/requests/colorama, and exploit.py containing all exploit logic. The exploit workflow is straightforward: it accepts either a single target (-u) or a file of targets (-f), optionally a command (-c), thread count (-t), and output file (-o). For each target, it constructs a SOAP XML request to /main/webservices/additional_webservices.php and injects the operator-supplied shell command into the file_name field of the wsConvertPpt request. The script then POSTs the XML with Content-Type: text/xml, disables TLS verification warnings, and parses the XML response for a <return> element to recover command output. Main capabilities include unauthenticated remote command execution, bulk targeting through ThreadPoolExecutor, randomized User-Agent selection from a local lib/ua.txt file, console status reporting, and optional result logging. The default command is uname -a. Because it executes arbitrary commands and attempts to retrieve output, this is an operational exploit rather than a mere detector. Notable implementation details: the script forcibly prepends http:// to targets, so HTTPS targets may be mishandled; the users_agents() function depends on lib/ua.txt, which is absent from the provided file list, so the script as provided may fail unless that file is added; the mkdir() helper is unused; and the output writer stores lines in the form 'Result: Results/{result}', which appears inconsistent with actual file handling. Despite these quality issues, the exploit intent and mechanism are clear: mass exploitation of vulnerable Chamilo instances through a crafted SOAP request carrying a shell command injection payload.

This repository contains a single Metasploit module targeting Chamilo LMS (versions 1.11.18 and below) for an unauthenticated remote command execution vulnerability (CVE-2023-34960). The exploit leverages a flaw in the PowerPoint upload SOAP service at '/main/webservices/additional_webservices.php', allowing attackers to execute arbitrary OS commands without authentication. The module supports multiple payloads, including PHP Meterpreter, Unix reverse bash shell, and Linux Meterpreter, and can upload a webshell disguised as a PNG file. The exploit is weaponized, providing reliable and repeatable exploitation with options for payload customization. The code is written in Ruby and structured as a standard Metasploit module, with clear separation of functions for checking vulnerability, uploading a webshell, and executing commands. The main attack vector is network-based, targeting a specific HTTP endpoint. The repository is operational and ready for use within the Metasploit framework.

This repository contains a proof-of-concept exploit for CVE-2023-34960, a vulnerability in Chamilo. The main file, poc.py, is a Python script that sends a crafted SOAP request to the /main/webservices/additional_webservices.php endpoint of a Chamilo instance. The exploit allows the user to check if a target is vulnerable and, if so, execute arbitrary system commands on the server by injecting them into the file_name parameter of the SOAP body. The repository consists of a README and the exploit script. The exploit is operational, as it provides a working payload and can execute attacker-supplied commands on a vulnerable target.

This repository provides an exploit for CVE-2023-34960, a command injection vulnerability in Chamilo LMS. The main exploit script is 'finder.py', a Python tool that automates the exploitation process. It reads a list of target URLs from a user-supplied file, then for each target, sends a crafted SOAP request to the '/main/webservices/additional_webservices.php' endpoint. The exploit injects a command via the 'file_name' parameter, causing the target to download and place a PHP web shell ('wso.php') from a remote GitHub repository. Successful exploitation is detected by parsing the SOAP response, and results are logged to 'resultVULN.txt'. The repository also includes a README with usage instructions, a requirements.txt for dependencies, and a placeholder text file. The exploit is operational, providing a working payload (web shell upload) and is intended for use against vulnerable Chamilo LMS installations.

This repository contains a Python 2.7 exploit script (CVE-2023-34960.py) targeting Chamilo e-learning platform's SOAP web service vulnerability (CVE-2023-34960). The exploit works by sending a specially crafted XML payload to the '/main/webservices/additional_webservices.php' endpoint, injecting a command that writes a base64-decoded PHP web shell ('shin.php') to the server. The script then attempts to access '/main/inc/lib/ppt2png/1.php' to verify if the shell was successfully uploaded. If successful, the attacker gains remote code execution via the web shell. The script supports multithreaded execution against a list of target URLs. The repository also includes a README.md with usage instructions and donation links. The exploit is operational, providing a working web shell payload, and is not part of any known exploit framework.

This repository contains a Python exploit for CVE-2023-34960, a mass unauthenticated command injection vulnerability in Chamilo LMS. The main file, 'exploit.py', is a command-line tool that allows the user to specify a target URL (or a file of URLs), a command to execute, and optional threading/output options. The exploit works by sending a crafted SOAP XML request to the '/main/webservices/additional_webservices.php' endpoint of the target Chamilo server, injecting the command into the 'file_name' parameter. The exploit is operational and allows for arbitrary command execution without authentication. The repository also includes a README.md with usage instructions and a requirements.txt listing dependencies. The exploit is cross-platform and can target both Linux and Windows Chamilo installations, provided the vulnerable endpoint is accessible. No hardcoded payload is present; the user supplies the command to execute, making this a flexible operational exploit.