CVE-2008-3261

The CVE-2008-3261 item concerns Claroline, where the redirector.php component in Claroline before 1.8.10 is vulnerable to an open redirect via the url parameter. This allows remote attackers to redirect users to arbitrary external sites, enabling phishing scenarios. Affected software is Claroline...

CVE-2008-3260

CVE-2008-3260 involves multiple XSS vulnerabilities in Claroline before 1.8.10. The issue allows remote attackers to inject arbitrary web script or HTML via the cwd parameter in document/rqmkhtml.php or the query string to several PHP scripts (announcements.php, calendar/agenda.php, course/index....

CVE-2008-3262

Cross-site request forgery CSRF vulnerability in Claroline before 1.8.10 allows remote attackers to change passwords, related to lack of a requirement for the previous password...

CVE-2008-3261

Open redirect vulnerability in claroline/redirector.php in Claroline before 1.8.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter...

CVE-2008-3260

Multiple cross-site scripting XSS vulnerabilities in Claroline before 1.8.10 allow remote attackers to inject arbitrary web script or HTML via 1 the cwd parameter in a rqMkHtml action to document/rqmkhtml.php, or the query string to 2 announcements/announcements.php, 3 calendar/agenda.php, 4...

Claroline 1.8 - useruser.php Query String Cross-Site Scripting

Claroline 1.8 - useruser.php Query String Cross-Site Scripting source: https://www.securityfocus.com/bid/30346/info Claroline is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...

Claroline 1.8 - learnPathcalendarmyagenda.php Query String Cross-Site Scripting

Claroline 1.8 - learnPathcalendarmyagenda.php Query String Cross-Site Scripting source: https://www.securityfocus.com/bid/30346/info Claroline is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues...

Claroline 1.8 - trackingcourseLog.php?view Cross-Site Scripting

Claroline 1.8 - trackingcourseLog.php?view Cross-Site Scripting source: https://www.securityfocus.com/bid/30346/info Claroline is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...

DSECRG-08-032.txt

Digital Security Research Group DSecRG Advisory DSECRG-08-032 Application: Claroline eLearning and eWorking platform Versions Affected: 1.8.10 Vendor URL: http://www.claroline.net/ Bug: Multiple Linked XSS Exploits: YES Reported: 18.07.2008 Vendor Response: 22.07.2008 Solution: YES Date of Public...

Claroline 1.8 - trackingtoolaccess_details.php?toolId Cross-Site Scripting

Claroline 1.8 - trackingtoolaccessdetails.php?toolId Cross-Site Scripting source: https://www.securityfocus.com/bid/30346/info Claroline is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to...

Claroline 1.8 - 'learnPath/calendar/myagenda.php' Query String Cross-Site Scripting

source: https://www.securityfocus.com/bid/30346/info Claroline is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

Claroline 1.8 - '/tracking/toolaccess_details.php?toolId' Cross-Site Scripting

source: https://www.securityfocus.com/bid/30346/info Claroline is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

Claroline 1.8 - 'user/user.php' Query String Cross-Site Scripting

source: https://www.securityfocus.com/bid/30346/info Claroline is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

Claroline 1.8 - '/tracking/courseLog.php?view' Cross-Site Scripting

source: https://www.securityfocus.com/bid/30346/info Claroline is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

[DSECRG-08-030] Claroline 1.8.9 Multiple Security Vulnerabilities

Digital Security Research Group DSecRG Advisory DSECRG-08-030 Application: Claroline eLearning and eWorking platform Versions Affected: 1.8.9 Vendor URL: http://www.claroline.net/ Bug: Multiple XSS, Phishing Through URL Redirection, Change User Password XSRF Vulnerability Exploits: YES Reported:...

DSECRG-08-030.txt

Digital Security Research Group DSecRG Advisory DSECRG-08-030 Application: Claroline eLearning and eWorking platform Versions Affected: 1.8.9 Vendor URL: http://www.claroline.net/ Bug: Multiple XSS, Phishing Through URL Redirection, Change User Password XSRF Vulnerability Exploits: YES Reported:...

Claroline 1.8.9 - groupgroup_space.php Cross-Site Scripting

Claroline 1.8.9 - groupgroupspace.php Cross-Site Scripting source: https://www.securityfocus.com/bid/30269/info Claroline is prone to multiple input-validation vulnerabilities: 1. Multiple cross-site scripting vulnerabilities. 2. A remote URI-redirection vulnerability. An attacker may leverage...

Claroline 1.8.9 - courseindex.php Cross-Site Scripting

Claroline 1.8.9 - courseindex.php Cross-Site Scripting source: https://www.securityfocus.com/bid/30269/info Claroline is prone to multiple input-validation vulnerabilities: 1. Multiple cross-site scripting vulnerabilities. 2. A remote URI-redirection vulnerability. An attacker may leverage these...

Claroline 1.8.9 - course_descriptionindex.php Cross-Site Scripting

Claroline 1.8.9 - coursedescriptionindex.php Cross-Site Scripting source: https://www.securityfocus.com/bid/30269/info Claroline is prone to multiple input-validation vulnerabilities: 1. Multiple cross-site scripting vulnerabilities. 2. A remote URI-redirection vulnerability. An attacker may...

Claroline 1.8.9 - documentdocument.php Cross-Site Scripting

Claroline 1.8.9 - documentdocument.php Cross-Site Scripting source: https://www.securityfocus.com/bid/30269/info Claroline is prone to multiple input-validation vulnerabilities: 1. Multiple cross-site scripting vulnerabilities. 2. A remote URI-redirection vulnerability. An attacker may leverage...