Chamilo Installer Exposure
Chamilo is susceptible to the Installation page exposure due to misconfiguration.
Chamilo是一种免费的电子学习工具,允许用户创建基于Web的在线学习应用程序。这是一个开源的电子学习平台,既轻巧又适应。 Chamilo Self Hosted LMS是一个基于PHP的Web应用程序,它使用MySQL数据库存储数据。它是电子学习最广泛的LMS之一,全球拥有2000万人。 Chamilo 2.0仍在开发中,但是,用户仍然可以使用它直到版本1.11.x。它是根据GNU/GPLV3许可证发布的。这个免费的学习管理系统是跨平台,可在Windows,Linux和Mac OS X上使用。 Chamilo LMS包括几个有用的功能,例如课程目录,用户创建和角色管理,技能管理,证书创建,SCORM支持等等。它还设有购物车,以协助培训师销售课程和赚钱。 Chamilo E学习可用于各种学习和协作活动。教师可以使用网络创建,管理,发布其课程并跟踪受训者的进步。学生可以关注课程,阅读材料,积极参加小组,论坛和聊天室。 默认情况下,从数据库中对用户进行身份验证。另一方面,Chamilo具有一个LDAP模块,该模块允许管理员禁用数据库身份验证并将其替换为LDAP身份验证。开发人员还可以通过合并可用的扩展来修改和改善核心功能。 Chamilo开源LMS软件还允许构建定制扩展,以满足独特的业务需求。
共找到 7 条公开漏洞记录
Chamilo is susceptible to the Installation page exposure due to misconfiguration.
Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.
Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters.
Chamilo 1.1.14 contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
Chamilo LMS 1.11.14 is vulnerable to cross-site scripting.
A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.
main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter.