263 matches found
CVE-2007-2901
CVE-2007-2901: Affected software is Dokeos 1.8.0 and earlier. The vulnerability is multiple cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary web script or HTML via the img parameter to main/inc/lib/fckeditor/editor/plugins/ImageManager/editor.php and other unspecif...
CVE-2007-2902
SQL injection in Dokeos 1.8.0 and earlier affects main/auth/my_progress.php via the course parameter, allowing remote authenticated users to execute arbitrary SQL commands. Affected: Dokeos 1.8.0 and earlier. Root cause: unsafely constructed SQL in the course parameter. Impact per CVSS: partial c...
Sql injection
SQL injection vulnerability in tracking/courseLog.php in Dokeos 1.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the scormcontopen parameter...
CVE-2007-2889
SQL injection vulnerability in tracking/courseLog.php in Dokeos 1.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the scormcontopen parameter...
CVE-2007-2889
SQL injection vulnerability in tracking/courseLog.php in Dokeos 1.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the scormcontopen parameter...
CVE-2007-2889
CVE-2007-2889 corresponds to an SQL injection in tracking/courseLog.php of Dokeos (versions 1.6.5 and earlier). The underlying issue is that the scormcontopen parameter is unsafely used in SQL queries, enabling remote attackers to execute arbitrary SQL commands. Affected software: Dokeos 1.6.5 an...
dokeos165-sql.txt
!/usr/bin/perl -w Dokeos = 1.6.5 SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code courseLog.php: if $GET'scormcontopen' includeonceapigetlibrarypath.'/database.lib.php'; include'../scorm/XMLencode.php';...
dokeos180-sql.txt
!/usr/bin/perl -w Dokeos alertdocument.cookie Also, the amount of XSS vulnerabilites in this application is truely unbelievable...
Dokeos CourseLog.PHP SQL注入漏洞
Dokeos是一款基于PHP的WEB应用程序。 Dokeos不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息。 问题是'CourseLog.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL代码作为参数数据，可导致更改原来的SQL逻辑，获得敏感信息。 Dokeos Open Source Learning & Knowledge Management Tool 1.6.5 Dokeos Open Source Learning & Knowledge Management Tool 1.6.4 Dokeos Open Source Learnin...
Dokeos 1.6.5 - courseLog.php?scormcontopen SQL Injection
Dokeos 1.6.5 - courseLog.php?scormcontopen SQL Injection !/usr/bin/perl -w Dokeos = 1.6.5 SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code courseLog.php: if $GET'scormcontopen'...
Dokeos <= 1.8.0 (my_progress.php course) Remote SQL Injection Exploit
No description provided by source. !/usr/bin/perl -w Dokeos = 1.8.0 SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com &n...
Dokeos <= 1.6.5 (courseLog.php scormcontopen) SQL Injection Exploit
Exploit for unknown platform in category web applications =================================================================== Dokeos = 1.6.5 courseLog.php scormcontopen SQL Injection Exploit =================================================================== !/usr/bin/perl -w Dokeos = 1.6.5 SQL...
Dokeos <= 1.6.5 (courseLog.php scormcontopen) SQL Injection Exploit
No description provided by source. !/usr/bin/perl -w Dokeos = 1.6.5 SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code courseLog.php: if $GET'scormcontopen' includeonceapigetlibrarypath.'/database.lib.php';...
Dokeos 1.6.5 - 'courseLog.php?scormcontopen' SQL Injection
!/usr/bin/perl -w Dokeos = 1.6.5 SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code courseLog.php: if $GET'scormcontopen' includeonceapigetlibrarypath.'/database.lib.php'; include'../scorm/XMLencode.php';...
Dokeos 1.8.0 - my_progress.php?course SQL Injection
Dokeos 1.8.0 - myprogress.php?course SQL Injection !/usr/bin/perl -w Dokeos = 1.8.0 SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code myprogress.php: ifisset$GET'course' $sqlInfosCourse = "SELECT course.code,...
Dokeos 1.8.0 - 'my_progress.php?course' SQL Injection
!/usr/bin/perl -w Dokeos = 1.8.0 SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code myprogress.php: ifisset$GET'course' $sqlInfosCourse = "SELECT course.code, course.title,course.dbname,CONCATuser.firstname,'...
Dokeos <= 1.8.0 (my_progress.php course) Remote SQL Injection Exploit
Exploit for unknown platform in category web applications ===================================================================== Dokeos = 1.8.0 myprogress.php course Remote SQL Injection Exploit ===================================================================== !/usr/bin/perl -w Dokeos = 1.8.0...
Dokeos 1.6.4 - Multiple Remote File Inclusions Vulnerabilities
Dokeos 1.6.4 - Multiple Remote File Inclusions Vulnerabilities source: https://www.securityfocus.com/bid/20468/info Dokeos is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can explo...
Dokeos 1.6.4 - Multiple Remote File Inclusions Vulnerabilities
source: https://www.securityfocus.com/bid/20468/info Dokeos is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file containing...