CVE-2023-3533

The file `/main/webservices/additional_webservices.php` does not require authentication and does not properly filter paths passed during file uploads. An attacker can construct a request containing path traversal sequences (e.g., `../`), allowing file writing to any location accessible to the web server process. By placing an executable file (e.g., webshell) outside the intended directory this way, the attacker gains the ability to invoke it through a browser and thus achieve remote code execution on the server.

An unauthenticated attacker can gain full control over the server through RCE, as well as conduct stored XSS attacks on application users by uploading malicious files to accessible web locations.

Update Chamilo LMS to a version containing the patch available in commit 37be9ce7243a30259047dd4517c48ff8b21d657a. Patch details are available in vendor references (support.chamilo.org and GitHub). As an interim measure, consider restricting access to the file `/main/webservices/additional_webservices.php` at the web server configuration level or through a web application firewall.

Chamilo LMS version 1.11.20 and earlier.