CVE-2026-45140 Splunk · SPL

Detect Chamilo LMS CStudio Unauthenticated Upload RCE (CVE-2026-45140) in Splunk

Detects exploitation of CVE-2026-45140, an unauthenticated remote code execution flaw in Chamilo LMS (<= 2.0.0) via the CStudio content upload flow. The vulnerability chains path traversal (CWE-22), code injection (CWE-94), and unrestricted file upload (CWE-434) to write and execute attacker-controlled PHP on the server without authentication. Detection focuses on anonymous POST requests to CStudio/document upload endpoints, subsequent GET requests to attacker-written scripts under web-accessible upload/course paths, and web-server process spawning shells or interpreters.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence

SPL Detection Query

Splunk (SPL)
spl 
index=web (sourcetype="iis" OR sourcetype="apache:access" OR sourcetype="nginx:access")
| eval anon=if(isnull(user) OR user="-" OR user="", 1, 0)
| where (method="POST" AND (like(uri_path,"%cstudio%") OR like(uri_path,"%/main/document/upload%") OR like(uri_path,"%/main/inc/ajax/document.ajax.php%") OR like(uri_path,"%ckeditor%"))) OR (method="GET" AND match(uri_path,"(?i)\.(php|phtml|php5|phar|pht)($|\?)") AND (like(uri_path,"%/courses/%") OR like(uri_path,"%/upload/%") OR like(uri_path,"%/main/document/%")))
| where anon=1
| stats count min(_time) as firstTime max(_time) as lastTime values(method) as methods values(uri_path) as uris values(status) as statuses by src_ip, useragent
| where count > 0
| convert ctime(firstTime) ctime(lastTime)
critical severity high confidence

Correlates anonymous upload POSTs to Chamilo CStudio endpoints and anonymous GET execution of PHP files in course/upload paths from the same source IP.

Data Sources

IIS/Web Server LogsApache/Nginx Access Logs

Required Sourcetypes

iisapache:accessnginx:access

False Positives & Tuning

  • Authenticated teachers whose username is not logged by the front-end proxy
  • Authorized vulnerability scans hitting the upload flow
  • Legitimate PHP assets served from course directories by plugins

Other platforms for CVE-2026-45140

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Anonymous CStudio upload POST simulation

    Expected signal: Web access log records an anonymous POST to document.ajax.php with a multipart file upload containing a traversal path.

  2. Test 2Webshell execution GET simulation

    Expected signal: Web access log records an anonymous GET to shell.php under /courses/ returning HTTP 200.

  3. Test 3Web-server spawns shell after RCE

    Expected signal: auditd/EDR records a process-creation event with www-data as parent of /bin/sh executing id and uname.

Last updated: 2026-09-18 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the target host runs Chamilo LMS at or below version 2.0.0 (check composer.lock / chamilo/chamilo-lms and the platform version banner); versions >= 2.0.1 are patched.
  2. Review the flagged anonymous POST requests to CStudio/document upload endpoints and identify any newly written files under web-accessible course/upload directories with PHP-executable extensions.
  3. Correlate the source IP's subsequent GET requests to determine whether an uploaded PHP file returned HTTP 200 (successful execution) versus 403/404.
  4. Inspect the web-server process tree for the request window for shells or interpreters (sh, bash, php, python) spawned by the web-server user.

Containment

  1. Block the offending source IP(s) at the WAF/edge and add a temporary rule denying POST requests to the CStudio/document upload endpoints from unauthenticated sessions.
  2. Quarantine or remove any attacker-written PHP files identified in course/upload directories and revoke write permissions on those directories where feasible.
  3. Upgrade Chamilo LMS to >= 2.0.1 or apply the vendor fix from commit 4bdba1b9a8820bd70c0809317775d7f6eaa79844.

Evidence Collection

  1. Preserve web-server access and error logs covering the exploitation window, capturing source IP, User-Agent, request bodies, and response codes.
  2. Image or copy the uploaded PHP artifacts and any files they created, recording file hashes, timestamps, and ownership before removal.
  3. Export the web-server process-creation telemetry (EDR/auditd/Sysmon) showing any child processes spawned by the web-server account.

Escalation Criteria

  • !Escalate to incident response if any uploaded PHP file returned HTTP 200 or if web-server-spawned shell/interpreter processes are observed, indicating confirmed code execution.
  • !Escalate if evidence of lateral movement, credential access, or persistence (cron jobs, new accounts, modified web roots) is found beyond the initial upload.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Attacker-written PHP files (unusual names, recent mtime) under /courses/, /upload/, or /main/document/ directories
  • >Web-server access log entries showing anonymous POSTs to CStudio endpoints followed by GETs to the written PHP files
  • >Process-creation records where the web-server user (www-data/apache/IIS APPPOOL) is the parent of sh/bash/php/python

Tuning Guidance

Baseline the legitimate set of PHP files served from course/upload directories and the normal upload volume from authenticated instructors, then suppress those known paths. If a fronting proxy strips authentication context, enrich web logs with session or auth-cookie presence to distinguish truly anonymous requests before alerting. Exclude approved vulnerability scanner source IPs.

Hunting Queries

Hunts for GET requests to PHP files inside course/upload directories that are not part of the known Chamilo application file set, indicating attacker-planted webshells.

Hunting — KQL
kql 
W3CIISLog | where csMethod == "GET" and csUriStem matches regex @"(?i)\.(php|phtml|phar)$" and csUriStem has_any ("/courses/", "/upload/") | summarize hits=count(), firstSeen=min(TimeGenerated) by csUriStem, cIp | where hits >= 1
Hunting — SPL
spl 
index=web sourcetype="apache:access" method=GET uri_path="*/courses/*" (uri_path="*.php" OR uri_path="*.phtml") | stats count min(_time) as firstSeen by uri_path, src_ip

Atomic Red Team Tests

Test 1 Anonymous CStudio upload POST simulation
linux

Simulates an unauthenticated POST of a PHP payload to the Chamilo CStudio/document upload endpoint against a lab instance.

Command

bash 
curl -s -o /dev/null -w '%{http_code}\n' -X POST 'http://chamilo-lab.local/main/inc/ajax/document.ajax.php?a=upload_file' -F 'file=@/tmp/shell.php;type=application/x-php' -F 'curdirpath=../../../courses/testcourse/document'

Cleanup

bash 
rm -f /var/www/chamilo/courses/testcourse/document/shell.php /tmp/shell.php

Expected Telemetry

Web access log records an anonymous POST to document.ajax.php with a multipart file upload containing a traversal path.

Expected Detection

KQL/SPL upload-endpoint rules fire on the anonymous POST to the CStudio upload path.

Test 2 Webshell execution GET simulation
linux

Requests a previously uploaded PHP file in a web-accessible course directory to simulate webshell execution.

Command

bash 
printf '<?php echo "pwned"; ?>' > /var/www/chamilo/courses/testcourse/document/shell.php; curl -s 'http://chamilo-lab.local/courses/testcourse/document/shell.php'

Cleanup

bash 
rm -f /var/www/chamilo/courses/testcourse/document/shell.php

Expected Telemetry

Web access log records an anonymous GET to shell.php under /courses/ returning HTTP 200.

Expected Detection

Detection rules flag the anonymous GET to a PHP file in a course/upload directory following the upload POST.

Test 3 Web-server spawns shell after RCE
linux

Simulates code execution by having the web-server user spawn a shell command, as would occur after successful exploitation.

Command

bash 
sudo -u www-data /bin/sh -c 'id; uname -a'

Cleanup

bash 
echo 'no cleanup required — read-only reconnaissance commands'

Expected Telemetry

auditd/EDR records a process-creation event with www-data as parent of /bin/sh executing id and uname.

Expected Detection

Process-lineage detection flags the web-server user spawning a shell interpreter.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1505.003Web ShellT1059.004Unix Shell

Same Tactic: Initial Access

Popular Detections