[Full-disclosure] Dokeos 1.6.4 SQL Injection Vulnerability

Dokeos 1.6.4 SQL Injection Vulnerability Author: Alvaro Olavarria [email protected] Affected: Dokeos = 1.6.4 Status: Notified hereby Vendor url: http://www.dokeos.com Background. Dokeos is an Open Source elearning and course management web application translated in 34 languages and helping mor...

CVE-2005-2598

CVE-2005-2598 affects Dokeos 1.6 and earlier, and possibly Claroline. The issue consists of multiple directory traversal vulnerabilities that allow remote attackers to (1) delete arbitrary files or directories via the delete parameter to claroline/scorm/scormdocument.php, (2) move arbitrary files...

CVE-2005-2598

Multiple directory traversal vulnerabilities in Dokeos 1.6 and earlier, and possibly Claroline, allow remote attackers to 1 delete arbitrary files or directories via the delete parameter to claroline/scorm/scormdocument.php, 2 move arbitrary files via the moveto and movefile parameters to...

CVE-2005-2598

Multiple directory traversal vulnerabilities in Dokeos 1.6 and earlier, and possibly Claroline, allow remote attackers to 1 delete arbitrary files or directories via the delete parameter to claroline/scorm/scormdocument.php, 2 move arbitrary files via the moveto and movefile parameters to...

[SA16407] Dokeos Multiple Directory Traversal Vulnerabilities

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

[Full-disclosure] Dokeos - Multiple Vulnerabilities

2 months ago we published an advisory about the Claroline application: http://www.zone-h.org/advisories/read/id=7472 Dokeos www.dokeos.com 1.5.5 has the same vulnerabilities than Claroline because it was based on it, but not all of them: there are 3 file inclusion vulnerabilities, and some of the...

CVE-2005-1375

Multiple SQL injection vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to execute arbitrary SQL commands via 1 learningPath.php, 2 learningPathAdmin.php, 3 learnPathdetails.php, 4 modulespool.php, 5 module.php, 6 uInfo parameter in...

CVE-2005-1377

Multiple PHP remote file inclusion vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to execute arbitrary PHP code via unknown vectors...

CVE-2005-1376

Multiple directory traversal vulnerabilities in 1 document.php or 2 insertMyDoc.php in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote project administrators to upload arbitrary files...

CVE-2005-1374

Multiple cross-site scripting XSS vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to inject arbitrary web script or HTML via 1 exerciseresult.php, 2 exercicesubmit.php, 3 agenda.php, 4 learningPathList.php, 5 learningPathAdmin.php, 6...

CVE-2005-1375

Multiple SQL injection vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to execute arbitrary SQL commands via 1 learningPath.php, 2 learningPathAdmin.php, 3 learnPathdetails.php, 4 modulespool.php, 5 module.php, 6 uInfo parameter in...

CVE-2005-1377

CVE-2005-1377 documents multiple PHP Remote File Include vulnerabilities in Claroline 1.5.3–1.6 Release Candidate 1 (and possibly Dokeos), enabling remote attackers to execute arbitrary PHP code via unknown vectors. Affected software is Claroline (and possibly Dokeos) with RFI issues; exploitatio...

CVE-2005-1374

CVE-2005-1374 : Multiple cross-site scripting (XSS) vulnerabilities affect Claroline versions 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos. The flaws allow remote attackers to inject arbitrary script/HTML via various parameters across multiple scripts (e.g., exercise_result.php, lea...

CVE-2005-1374

Multiple cross-site scripting XSS vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to inject arbitrary web script or HTML via 1 exerciseresult.php, 2 exercicesubmit.php, 3 agenda.php, 4 learningPathList.php, 5 learningPathAdmin.php, 6...

CVE-2005-1377

Multiple PHP remote file inclusion vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to execute arbitrary PHP code via unknown vectors...

CVE-2005-1375

Technical details about CVE-2005-1375 are not publicly provided in the supplied connected documents. Monitor for updates from authoritative advisories; the available sources only reiterate the existence of SQL injection vulnerabilities without specifics.

Claroline 1.51.6 - user_access_details.php?data Cross-Site Scripting

Claroline 1.51.6 - useraccessdetails.php?data Cross-Site Scripting source: https://www.securityfocus.com/bid/13407/info Multiple remote input validation vulnerabilities affect Claroline e-Learning Application. These issues are due to a failure of the application to properly sanitize user-supplied...

Claroline 1.51.6 - myagenda.php?coursePath Cross-Site Scripting

Claroline 1.51.6 - myagenda.php?coursePath Cross-Site Scripting source: https://www.securityfocus.com/bid/13407/info Multiple remote input validation vulnerabilities affect Claroline e-Learning Application. These issues are due to a failure of the application to properly sanitize user-supplied...

Claroline 1.5/1.6 - 'user_access_details.php?data' Cross-Site Scripting

source: https://www.securityfocus.com/bid/13407/info Multiple remote input validation vulnerabilities affect Claroline e-Learning Application. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical application...

Claroline E-Learning 1.51.6 - userInfo.php Multiple SQL Injections

Claroline E-Learning 1.51.6 - userInfo.php Multiple SQL Injections source: https://www.securityfocus.com/bid/13407/info Multiple remote input validation vulnerabilities affect Claroline e-Learning Application. These issues are due to a failure of the application to properly sanitize user-supplied...