CVE-2023-34960

Name of the Vulnerable Software and Affected Versions Chamilo versions 1.11.* through 1.11.18

Description A command injection issue in the wsConvertPpt component allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.

Recommendations For Chamilo versions 1.11.* through 1.11.18, consider restricting access to the wsConvertPpt component until a patch is available. As a temporary workaround, avoid using the SOAP API with crafted PowerPoint names to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.