SQL Injection in Dokeos

High-Tech Bridge Security Research Lab discovered vulnerability in Dokeos, which can be exploited to perform SQL Injection attacks.

1. SQL Injection in Dokeos: CVE-2013-6341
   The vulnerability exists due to insufficient validation of “language” HTTP GET parameter passed to “/index.php” script. A remote unauthenticated attacker can execute arbitrary SQL commands in application’s database and gain complete control over the vulnerable web application.
   The following exploitation example displays version of MySQL server:
   http://[host]/index.php?language=0%27%20UNION%20SELECT%201,2,3,4,version%28% 29,6,7,8%20–%202