CVE-2021-31933: 
Chamilo vulnerability analysis and mitigation

A remote code execution vulnerability was discovered in Chamilo through version 1.11.14. The vulnerability exists due to improper input sanitization of parameters used for file uploads and insufficient file-extension filtering for certain filenames (e.g., .phar or .pht). This vulnerability was disclosed on April 30, 2021 (NVD).

The vulnerability allows a remote authenticated administrator to upload a file containing arbitrary PHP code into specific directories via main/inc/lib/fileUpload.lib.php through directory traversal. The issue stems from insufficient validation of file extensions and improper sanitization of upload parameters. The vulnerability was addressed by adding additional file extension checks for .phar files in the php2phps() function and implementing proper path validation using Security::check_abs_path (GitHub Commit).

The vulnerability allows authenticated administrators to achieve PHP code execution on the affected system. This could potentially lead to complete system compromise, as the attacker could execute arbitrary commands with the permissions of the web server (Red Hat CVE).

The vulnerability requires authentication with administrator privileges to exploit. An attacker must be able to upload files to specific directories using the file upload functionality. The exploitation involves uploading a file with specific extensions (.phar or .pht) containing malicious PHP code (AttackerKB).

The vulnerability was patched by updating the .htaccess file to disable PHP execution inside the web/ directory and adding the phar extension to the php2phps() function for proper filtering. Additional security measures were implemented including path validation checks and course/user validations. Users should upgrade to a version after 1.11.14 that contains these security fixes (GitHub Commit).