CVE-2019-13082

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature. It extracts a ZIP archive before checking its content, and once it has been extracted, does not check files in a recursive way. This means that by putting a .php file in a folder and then this folder in a ZIP archive, the server will accept this file without any checks. Because one can access this file from the website, it is remote code execution. This is related to a scorm imsmanifest.xml file, the import_package function, and extraction in $courseSysDir.$newDir.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://0xecute.com/?p=32Exploit, Technical Description, Third Party Advisory
https://support.chamilo.org/projects/1/wiki/Security_issuesVendor Advisory
https://0xecute.com/?p=32Exploit, Technical Description, Third Party Advisory
https://support.chamilo.org/projects/1/wiki/Security_issuesVendor Advisory

Timeline

Published: Jun 30, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-130837.8XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000384e2a.CVE-2019-130847.8XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000026b739.CVE-2019-130857.8XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000030ecfa.CVE-2019-130869.8core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and CVE-2019-13096.8A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a priv CVE-2019-130969.8TronLink Wallet 2.2.0 stores user wallet keystore in plaintext and places them in insecure storage. An attacker can read and reuse the user CVE-2019-130977.5The application API of Cat Runner Decorate Home version 2.8.0 for Android does not sufficiently verify inputs that are assumed to be immutab CVE-2019-130986.5The user password via the registration form of TronLink Wallet 2.2.0 is stored in the log when the class CreateWalletTwoActivity is called. CVE-2019-130996.5The Momo application 2.1.9 for Android stores confidential information insecurely on the system (i.e., in cleartext), which allows a non-roo CVE-2019-13106.8A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a priv CVE-2019-131006.5The Send Anywhere application 9.4.18 for Android stores confidential information insecurely on the system (i.e., in cleartext), which allows CVE-2019-131019.8An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, whic