External risk intelligence

Chamilo wsConvertPpt Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-34960

Chamilo is a Learning Management System (LMS) typically deployed as a public-facing web application to allow students and instructors to access course materials over the internet. The vulnerable component is part of the web-accessible application interface, making it commonly reachable from the public internet in standard deployments.

Command Injection

Chamilo

1.11.0 to 1.11.18

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the Chamilo learning management system, specifically within its presentation conversion component. This flaw allows an unauthenticated attacker to execute arbitrary commands on the server by manipulating a PowerPoint file name through a SOAP API call. The potential for widespread impact is significant given the nature of command injection.

Allows attackers to run any command on the server.
It affects a widely used learning platform.
Confirm if your Chamilo system is exposed.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted SOAP API request to the wsConvertPpt component. This component is exposed through the web application, meaning it can be reached over the internet. If successful, the attacker could execute arbitrary commands on the underlying system.

No authentication required.
Triggered by a malicious PowerPoint name in a SOAP API call.
Allows remote code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

The `wsConvertPpt` component in Chamilo, when exposed via its SOAP API, could allow an attacker to execute arbitrary commands. This could occur when a crafted PowerPoint name is provided in a SOAP API call, potentially leading to unauthorized actions on the affected server.

Arbitrary command execution.
Crafted PowerPoint name via SOAP API.
Server compromise and data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

Chamilo LMS administrators and platform teams are likely responsible for addressing this vulnerability. The first practical step involves identifying all Chamilo deployments, confirming their internet reachability and business criticality, and then locating the accountable owner to plan remediation activities based on the assessed risk.

Identify Chamilo LMS instances.
Verify internet exposure and business criticality.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Chamilo and how is it used?

Chamilo is a Learning Management System (LMS) designed to host virtual classrooms. It provides a web-based environment where educators upload course materials and students access them. Because it functions as a central hub for educational content, it is frequently deployed on servers accessible to the public internet to ensure that users can connect from anywhere to complete their assignments.

What does command injection mean for CVE-2023-34960?

This vulnerability is classified as CWE-77, or Improper Neutralization of Special Elements used in an OS Command. In plain terms, the software fails to properly filter input provided by a user. Because the application processes this input insecurely, an attacker can append their own malicious system commands to a legitimate request. The server then mistakenly executes those added commands with the same privileges as the Chamilo application itself.

How is this vulnerability triggered?

An attacker triggers this flaw by interacting with the wsConvertPpt component via the SOAP API. They must submit a specifically crafted PowerPoint filename that contains malicious command sequences. It is important to note that this does not require valid credentials or authentication to the platform; however, requests that do not target the wsConvertPpt component or do not contain specifically formatted input strings will not trigger the vulnerability.

Why should I care about CVE-2023-34960?

You should care because Halo Surface Signal identifies Chamilo as a web-accessible application that is typically exposed to the public internet. Since this vulnerability allows unauthenticated remote code execution, any system reachable from the outside is at risk of being compromised by an attacker without needing a password or prior access to your internal network.

What steps should I take if I run Chamilo?

First, conduct an inventory to locate all active Chamilo installations within your infrastructure. Once identified, verify which instances are reachable from the public internet, as these represent the highest priority for remediation. Engage with the platform owners or administrators responsible for these specific servers to discuss the risk and prioritize the application of vendor-provided updates to close the vulnerable SOAP API entry point.

References

chamilo.com/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.