CVE-2023-3545

Summary

CVE-2023-3545 is a critical vulnerability affecting Chamilo Learning Management System (LMS) versions prior to 1.11.20 on Windows and Apache installations. The vulnerability lies in the `fileUpload.lib.php` library, where improper sanitization enables unauthenticated attackers to bypass file upload security mechanisms. By uploading a malicious `.htaccess` file, attackers can gain remote code execution capabilities. Privileged attackers can directly exploit this flaw, or it may be chained with other arbitrary file write vulnerabilities, such as CVE-2023-3533, to achieve the same outcome.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.