854 matches found
SQL Injection Vulnerability in ClientCourse.asmx?op, E-learning Management System of Xinwei Software
E-learning management system is an online learning platform of Shenzhen Xinwei Software Co. A SQL injection vulnerability exists in the ClientCourse.asmx?op= page of the E-learning management system of Xinwei Software. An attacker can exploit the vulnerability to obtain sensitive information from...
XML Entity Injection Vulnerability in Xinwei Software E-learning System
E-learning management system is an online learning platform of Shenzhen Xinwei Software Co. An XML entity injection vulnerability exists in the E-learning system of Xinwei Software. An attacker can use the vulnerability to remotely execute commands and gain server privileges...
SQL Injection Vulnerability in SmartClient.asmx?op Page of Xinwei Software E-learning System
E-learning management system is an online learning platform of Shenzhen Xinwei Software Co. A SQL injection vulnerability exists in the SmartClient.asmx?op page of Xinwei Software's E-learning system. An attacker can exploit the vulnerability to obtain sensitive information from the website...
Claroline 1.7.7 - Arbitrary File Inclusion
Claroline 1.7.7 - Arbitrary File Inclusion Claroline Arbitrary File Inclusion Vendor: Claroline Product: Claroline Version: 0 $uidReset = true; $clarologinSucceeded = true; break; e...
Claroline < 1.7.7 - Arbitrary File Inclusion
Claroline Arbitrary File Inclusion Vendor: Claroline Product: Claroline Version: 0 $uidReset = true; $clarologinSucceeded = true; break; else $uid =...
Docebo LMS 6.9 - (Moxie) API Calls RST RCE Vulnerability
Document Title: =============== Docebo LMS 6.9 - Moxie API Calls RST RCE Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1888 Video: http://www.vulnerability-lab.com/getcontent.php?id=1892 Release Date: ============= 2016-08-02 Vulnerabilit...
Times bright China e-Learning system /resin-doc/examples/security-basic/viewfile parameter file arbitrary file read vulnerability
No description provided by source...
New to E-learning /exam/api/On. asmx GetUserExamView interface parameters userUid injection vulnerability
No description provided by source...
Timber E-learning在线培训系统网校版 Search.aspx 参数select SQL注入漏洞
No description provided by source...
Timber E-learning在线培训系统 Type_List.aspx 参数typeid SQL注入漏洞
0x01 框架介绍 相关厂商： 上海天柏信息科技有限公司 公开时间： 2016-01-11 漏洞类型： SQL注射漏洞 官方主页： http://www.timber2005.com/ 案例：http://www.timber2005.com/Customer.html 0x02 漏洞细节 http://.../WebOrg/TypeList.aspx?typeid=1 0x03 修复方案 1、过滤漏洞文件参数 2、使用加速乐等防护产品...
Timber E-learning在线考试系统后台 /system/Dep_Right.aspx 参数DEP_NAME2 SQL注入漏洞
0x01漏洞简介 Timber E-learning在线考试系统的后台/system/DepRight.aspx对参数DEPNAME2过滤不严格，导致出现注入漏洞。远程攻击者先需要注册一个用户，登陆后台后可以利用这些漏洞执行SQL指令。该漏洞利用的步骤如下： 1访问页面/usercontrol/ajax.aspx输入用户名密码，进行登陆 http://www..com/usercontrol/ajax.aspx post: Action=post&username=&pwd=&func=Login 登陆成功，将返回true，否则返回false 2登陆成功后，可以利用注入漏洞执行SQL指令...
promotion-sociale-marche.be XSS vulnerability
Vulnerable URL: http://www.promotion-sociale-marche.be/e-learning/claroline/backends/download.php?url=aHR0cDovL2cuZTxzdmcgb25sb2FkPWFsZXJ0KCJYU1NQT1NFRCIpPg==%3D=true=TOUS&7880348a71b083f9544b8331e92830aa=de5c42b513f83b302438c4e30c6df000 Details: Description| Value ---|--- Patched:| No Latest che...
新为软件E-learning 文件上传漏洞
No description provided by source...
Timber E-learning在线考试系统后台 /Paper/Paper_Manage.aspx 等13处 SQL注入漏洞
No description provided by source...
Timber E-learning在线考试系统商业版 /Web/User_Sort_List.aspx等8处 SQL注入漏洞
No description provided by source...
Timber E-learning在线培训系统政府版/Web/New.aspx 等9处 SQL注入漏洞
No description provided by source...
Timber E-learning 天柏在线考试系统 Exam_List.aspx 参数typeid SQL注入漏洞
0x01漏洞简介 Timber E-learning 天柏在线考试系统在/Web/ExamList.aspx由于对参数typeid过滤不严，导致出现SQL注入漏洞。远程攻击者可以结合错误回显的方式执行SQL指令，获取敏感信息。 0x02漏洞利用 以下面为例子： http:///Web/ExamList.aspx?typeid=141 and dbname0 0x03修复方案 过滤，或使用参数化的SQL语句。...
Arbitrary File Content Disclosure in Atutor
High-Tech Bridge Security Research Lab discovered path traversal vulnerability in a popular web-based e-learning system Atutor. A remote attacker can view contents of arbitrary local files on the target system with privileges of the web server. The vulnerability may allow an attacker gain access ...
DOKEOS ce30 Authentication Bypass
Advisory ID: HTB23289 Product: DOKEOS Vendor: DOKEOS Vulnerable Versions: ce30 and probably prior Tested Version: ce30 Advisory Publication: January 7, 2016 without technical details Vendor Notification: January 7, 2016 Public Disclosure: February 17, 2016 Vulnerability Type: Improper...