CVE-2015-4462: Unrestricted Upload of File with Dangerous Type

Absolute path traversal vulnerability in the filemanager component of eFront CMS before 3.6.15.5 allows remote authenticated users to read arbitrary files via a full pathname in the "Upload file from url" field in the file manager for professor.php...

PT-2017-6761

Name of the Vulnerable Software and Affected Versions eFront CMS versions prior to 3.6.15.5 Description The issue allows remote authenticated users to bypass intended file-upload restrictions. This is achieved by appending a crafted parameter to the file URL, potentially allowing unauthorized fil...

PT-2017-6760

Name of the Vulnerable Software and Affected Versions eFront CMS versions prior to 3.6.15.5 Description The issue allows remote authenticated users to read arbitrary files by providing a full pathname in the Upload file from url field within the file manager for professor.php. Recommendations For...

eFront libraries/includes/social.php SQL Injection

SQL Injection vulnerability in eFront libraries/includes/social.php id parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

Epignosis eFront Code Execution Vulnerability

Epignosis eFront is an online learning system with an Ajax interface from Epignosis USA. The system allows you to create and manage courses with tools such as a content editor, file manager, and digital library. A code execution vulnerability exists in the globals.php page in eFront version 3.6.1...

eFront 3.6.15 Code Execution Vulnerability

Exploit for php platform in category web applications A friend reminded me a couple of days ago to publish something, since its been a while last I published a post. so this is going to be a short post about an interesting-ish RCE found in all versions of eFront LMS - unfortunately, since the...

eFront 3.6.15 Code Execution

TL,DR; A friend reminded me a couple of days ago to publish something, since its been a while last I published a post. so this is going to be a short post about an interesting-ish RCE found in all versions of eFront LMS - unfortunately, since the report have passed 90 days since initial report, I...

eFront Learning CMS Cross-Site Scripting Vulnerability

eFront is an online learning system. A cross-site scripting vulnerability exists in eFront. A remote attacker can exploit the vulnerability to inject malicious script code into the affected application...

eFront Learning CMS Cross-Site Scripting Vulnerability (CNVD-2016-03584)

eFront is an online learning system. A cross-site scripting vulnerability exists in eFront. Because the program fails to properly filter user-supplied input, an attacker can exploit the vulnerability to steal cookie-based authentication information and execute arbitrary script in the browser...

eFront 3.6.15.6 CMS – Attachment Cross Site Vulnerability

Document Title: =============== eFront 3.6.15.6 CMS – Attachment Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1765 Release Date: ============= 2016-02-23 Vulnerability Laboratory ID VL-ID: ====================================...

eFront Learning 3.6.15.6 CMS - Persistent Web Vulnerability

Document Title: =============== eFront Learning 3.6.15.6 CMS - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1761 Release Date: ============= 2016-02-22 Vulnerability Laboratory ID VL-ID: ===================================...

Epignosis eFront has multiple vulnerabilities

Epignosis eFront is an online learning system with an Ajax interface from Epignosis USA. The system allows you to create and manage courses with tools such as a content editor, file manager, and digital library. A security vulnerability exists in Epignosis eFront. An attacker can exploit the...

eFront Detection

Binary data efrontdetect.nbin...

eFront < 3.6.15.4 Build 18023 Multiple Vulnerabilities

According to its version number, the version of eFront running on the remote web server is affected by multiple vulnerabilities : - A path traversal vulnerability exists due to improper sanitization of user-supplied input to the 'file' parameter of the viewfile.php script. A remote attacker can...

eFront 3.6.15 - Multiple SQL Injections

eFront 3.6.15 - Multiple SQL Injections eFront 3.6.15 Multiple SQL Injection Vulnerabilities + Author: Filippo Roncari | Luca De Fulgentis + Target: eFront + Version: 3.6.15 and probably lower + Vendor: www.efrontlearning.net + Accessibility: Remote + Severity: High + CVE: + Full Advisory:...

eFront 3.6.15 - Directory Traversal

eFront 3.6.15 - Directory Traversal eFront 3.6.15 Path Traversal Vulnerability + Author: Filippo Roncari + Target: eFront + Version: 3.6.15 and probably lower + Vendor: www.efrontlearning.net + Accessibility: Remote + Severity: High + CVE: + Full Advisory:...

eFront 3.6.15 - PHP Object Injection

eFront 3.6.15 - PHP Object Injection eFront 3.6.15 PHP Object Injection Vulnerability + Author: Filippo Roncari + Target: eFront + Version: 3.6.15 and probably lower + Vendor: www.efrontlearning.net + Accessibility: Remote + Severity: High + CVE: + Full Advisory:...

eFront 3.6.15 - Multiple SQL Injections

eFront 3.6.15 Multiple SQL Injection Vulnerabilities + Author: Filippo Roncari | Luca De Fulgentis + Target: eFront + Version: 3.6.15 and probably lower + Vendor: www.efrontlearning.net + Accessibility: Remote + Severity: High + CVE: + Full Advisory:...

eFront 3.6.15 - Directory Traversal

eFront 3.6.15 Path Traversal Vulnerability + Author: Filippo Roncari + Target: eFront + Version: 3.6.15 and probably lower + Vendor: www.efrontlearning.net + Accessibility: Remote + Severity: High + CVE: + Full Advisory: https://www.securenetwork.it/docs/advisory/SN-15-02eFront.pdf + Info:...

eFront 3.6.15 - PHP Object Injection

eFront 3.6.15 PHP Object Injection Vulnerability + Author: Filippo Roncari + Target: eFront + Version: 3.6.15 and probably lower + Vendor: www.efrontlearning.net + Accessibility: Remote + Severity: High + CVE: + Full Advisory: https://www.securenetwork.it/docs/advisory/SN-15-02eFront.pdf + Info:...