Description
A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Chamilo unauthenticated command injection in PowerPoint upload
exploit/linux/http/chamilo_unauth_rce_cve_2023_34960
GitHub 6 repositories
-
Aituglo/CVE-2023-34960 ★ 34 · Jun 9, 2023
CVE-2023-34960 Chamilo PoC
-
Ap0dexMe0/CVE-2023-34960 ★ 23 · Jul 22, 2023
Perform with Massive Command Injection (Chamilo)
-
Mantodkaz/CVE-2023-34960 ★ 4 · Jul 24, 2023
-
Jenderal92/CHAMILO-CVE-2023-34960 ★ 1 · Jul 3, 2023
Wordpress CVE-2023-34960
-
tpdlshdmlrkfmcla/cve-2023-34960 ★ 0 · Mar 30, 2025
chamilo soap api rce (/webservices/additional_webservices.php)
-
YongYe-Security/CVE-2023-34960 ★ 0 · Jul 9, 2023
Chamilo CVE-2023-34960 Batch scan/exploit
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Chamilo Command Injection http/cves/2023/CVE-2023-34960.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.