IBM Kenexa LMS on Cloud Directory Traversal Vulnerability (CNVD-2016-11279)

IBM Kenexa LMS on Cloud is a full-featured, configurable, enterprise-grade, social Learning Management System LMS that integrates social networking, collaboration, and knowledge sharing capabilities. The software provides interactive elements that support users in evaluating learning content and...

IBM Kenexa LMS on Cloud suffers from an unspecified cross-site scripting vulnerability (CNVD-2016-11290)

IBM Kenexa LMS on Cloud is a full-featured, configurable, enterprise-grade, social Learning Management System LMS with integrated social networking, collaboration, and knowledge sharing capabilities. IBM Kenexa LMS on Cloud suffers from an unspecified cross-site scripting vulnerability that stems...

eFront 3.6.15 Code Execution Vulnerability

Exploit for php platform in category web applications A friend reminded me a couple of days ago to publish something, since its been a while last I published a post. so this is going to be a short post about an interesting-ish RCE found in all versions of eFront LMS - unfortunately, since the...

eFront 3.6.15 Code Execution

TL,DR; A friend reminded me a couple of days ago to publish something, since its been a while last I published a post. so this is going to be a short post about an interesting-ish RCE found in all versions of eFront LMS - unfortunately, since the report have passed 90 days since initial report, I...

Learning Management System 0.1 - Authentication Bypass

Exploit Title.............. Learning Management System Auth Bypass Google Dork................ N/A Date....................... 14/10/2016 Exploit Author............. lahilote Vendor Homepage............ http://www.sourcecodester.com/php/7339/learning-management-system.html Software...

IIBM Kenexa LMS on Cloud SQL Injection Vulnerability

IBM Kenexa LCMS Premier is a product of IBM Corporation, USA. A SQL injection vulnerability exists in IBM Kenexa LMS cloude version 5.2, which can be exploited by an attacker to compromise an application, either by accessing and modifying data, or by tampering with a database...

Docebo LMS 6.9 Remote Code Execution

Document Title: =============== Docebo LMS 6.9 - Moxie API Calls RST Remote Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1888 Video: http://www.vulnerability-lab.com/getcontent.php?id=1892 Release Date: =============...

Docebo LMS 6.9 - (Moxie) API Calls RST RCE Vulnerability

Document Title: =============== Docebo LMS 6.9 - Moxie API Calls RST RCE Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1888 Video: http://www.vulnerability-lab.com/getcontent.php?id=1892 Release Date: ============= 2016-08-02 Vulnerabilit...

Docebo LMS 6.9 - (Moxie) API Calls RST RCE PoC

Document Title: =============== Docebo LMS 6.9 - Moxie API Calls RST RCE PoC References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1892 PoC Video: https://www.youtube.com/watch?v=YF57jTPESgQ Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1888 Release Date:...

Docebo LMS 6.9 - (Moxie) API Calls RST RCE PoC

Document Title: =============== Docebo LMS 6.9 - Moxie API Calls RST RCE PoC References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1892 PoC Video: https://www.youtube.com/watch?v=YF57jTPESgQ Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1888 Release Date:...

Docebo LMS 6.9 - (Moxie) API Calls RST RCE Vulnerability

Document Title: =============== Docebo LMS 6.9 - Moxie API Calls RST RCE Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1888 Video: http://www.vulnerability-lab.com/getcontent.php?id=1892 Release Date: ============= 2016-08-01 Vulnerabilit...

Chamilo LMS SQL Injection Vulnerability

Chamilo LMS is an open source online learning and collaboration system developed by the Chamilo Association. The system supports the creation of instructional content, distance training and online question and answer sessions. Chamilo LMS suffers from SQL injection vulnerabilities that stem from...

SRC-2016-0017 : ATutor LMS view_item File Disclosure Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability may allow remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is required to exploit this vulnerability however authentication bypass vulnerabilities are known and remote registration is open by default. The...

SRC-2016-0020 : ATutor LMS view_transcript File Disclosure Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability may allow remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is required to exploit this vulnerability however authentication bypass vulnerabilities are known and remote registration is open by default. The...

SRC-2016-0018 : ATutor LMS view_transcript File Disclosure Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability may allow remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is required to exploit this vulnerability however authentication bypass vulnerabilities are known and remote registration is open by default. The...

SRC-2016-0015 : ATutor LMS write_temp_file File Write Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is required to exploit this vulnerability however authentication bypass vulnerabilities are known and remote registration is open by default. The...

SRC-2016-0019 : ATutor LMS get_course_icon File Disclosure Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability may allow remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is required to exploit this vulnerability however authentication bypass vulnerabilities are known and remote registration is open by default. The...

SRC-2016-0009 : ATutor LMS password_reminder TOCTOU Authentication Bypass Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is required to exploit this vulnerability however authentication bypass vulnerabilities are known and remote registration is open by default. The...

SRC-2016-0008 : ATutor LMS confirm ‘SELECT’ Type Juggling Authentication Bypass Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to bypass the authentication mechanism on vulnerable installations of ATutor. The specific flaw exists in the ‘confirm.php’ script when performing an automated login. The code uses a loose comparison when comparing the supplied...

Chamilo LMS 1.10.2 Cross Site Scripting

Document Title: =============== Chamlio LMS v1.10.2 - Profile Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1781 Release Date: ============= 2016-03-14 Vulnerability Laboratory ID VL-ID: ====================================...