A critical arbitrary file upload vulnerability in Chamilo LMS allows authenticated attackers to execute remote code on the underlying server.

The application fails to properly validate file types within the elfinder filemanager module. An authenticated user can upload a file masquerading as an image, rename it to a PHP extension, and subsequently execute it to achieve remote code execution.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands on the server hosting the Learning Management System. This can lead to total system compromise, unauthorized access to sensitive student or institutional data, and the potential for lateral movement within the network. With a CVSS score of 8.8, this vulnerability represents a high-risk threat to organizational integrity and data confidentiality.

Immediate Action: Upgrade Chamilo LMS to the latest supported version where this vulnerability is resolved. Ensure that all temporary upload directories are configured with no-execute permissions to prevent the execution of uploaded scripts.

Proactive Monitoring: Review web server access logs for requests targeting the elfinder filemanager or unusual file access patterns in the uploads directory. Monitor for suspicious PHP files created in user-accessible folders.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block requests that attempt to upload files with dangerous extensions or inconsistent MIME types. Restrict file upload functionality to trusted users and enforce strict server-side validation of file content.

Public Exploit Available: Yes, a published proof-of-concept exists via the Exploit-DB entry 47423.

The presence of a public proof-of-concept, combined with the potential for remote code execution, necessitates immediate attention. Administrators must prioritize updating the Chamilo LMS software to a patched version to eliminate this attack vector. Failure to remediate this issue leaves the application vulnerable to full server compromise by any authenticated user.