CVE-2009-2149

The CVE-2009-2149 entry describes multiple cross-site scripting (XSS) vulnerabilities in Campus Virtual-LMS. Attackers can inject arbitrary web script or HTML via parameters in specific pages: (1) courseid on enrolments/step1.php and (2) search or (3) siteid on files/shared_list.php. The affected...

CVE-2009-2150

CVE-2009-2150 has concrete details: CSRF vulnerabilities in Campus Virtual-LMS. The issues enable remote attackers to hijack the authentication of arbitrary users for requests that terminate a session via login/logout.php, and may also allow hijacking via ADD or DELETE actions to enrolments/step2...

CVE-2009-2149

Multiple cross-site scripting XSS vulnerabilities in Campus Virtual-LMS allow remote attackers to inject arbitrary web script or HTML via the 1 courseid parameter to enrolments/step1.php, or the 2 search or 3 siteid parameter to files/sharedlist.php...

CVE-2009-2150

Multiple cross-site request forgery CSRF vulnerabilities in Campus Virtual-LMS allow 1 remote attackers to hijack the authentication of arbitrary users for requests that terminate a session via login/logout.php, and might allow remote attackers to hijack the authentication of certain users via a ...

CVE-2009-2148

SQL injection vulnerability in news/index.php in Campus Virtual-LMS allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2009-2148: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in news/index.php in Campus Virtual-LMS allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2009-2149: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Campus Virtual-LMS allow remote attackers to inject arbitrary web script or HTML via the 1 courseid parameter to enrolments/step1.php, or the 2 search or 3 siteid parameter to files/sharedlist.php...

CVE-2009-2150: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Campus Virtual-LMS allow 1 remote attackers to hijack the authentication of arbitrary users for requests that terminate a session via login/logout.php, and might allow remote attackers to hijack the authentication of certain users via a ...

Campus Virtual-LMS XSRF / XSS / SQL Injection

+-----------------------------------------------------------------------------+ LMS: Campus Virtual-LMS WEB: http://campusvirtualcomputrade.cae.net Autor: Yasión Fecha: 12 jun 2009 +-----------------------------------------------------------------------------+...

Campus Virtual-LMS (XSS/SQL Injection) Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications ====================================================================== Campus Virtual-LMS XSS/SQL Injection Multiple Remote Vulnerabilities ======================================================================...

Campus Virtual-LMS (XSS/SQL Injection) Multiple Remote Vulnerabilities

No description provided by source. +-----------------------------------------------------------------------------+ LMS: Campus Virtual-LMS WEB: http://campusvirtualcomputrade.cae.net Autor: Yasión Fecha: 12 jun 2009 +-----------------------------------------------------------------------------+...

campus virtual-lms - Cross-Site Scripting SQL Injection

campus virtual-lms - Cross-Site Scripting SQL Injection +-----------------------------------------------------------------------------+ LMS: Campus Virtual-LMS WEB: http://campusvirtualcomputrade.cae.net Autor: Yasión Fecha: 12 jun 2009...

campus virtual-lms - Cross-Site Scripting / SQL Injection

+-----------------------------------------------------------------------------+ LMS: Campus Virtual-LMS WEB: http://campusvirtualcomputrade.cae.net Autor: Yasión Fecha: 12 jun 2009 +-----------------------------------------------------------------------------+...

Dokeos LMS <= 1.8.5 (include) Remote Code Execution Exploit

No description provided by source. !/usr/bin/perl Dokeos LMS = 1.8.5 "include" Remote Code Execution Exploit Description --------------------------------------------------------------- Dokeos LMS contains one flaw that allows an attacker to include a local file with "html" extension. The issue is...

Dokeos LMS <= 1.8.5 (include) Remote Code Execution Exploit

Exploit for unknown platform in category web applications...

Dokeos LMS 1.8.5 Code Execution

!/usr/bin/perl Dokeos LMS = 1.8.5 "include" Remote Code Execution Exploit Description --------------------------------------------------------------- Dokeos LMS contains one flaw that allows an attacker to include a local file with "html" extension. The issue is due to 'userportal.php' script not...

Dokeos Lms 1.8.5 - Include Remote Code Execution

Dokeos Lms 1.8.5 - Include Remote Code Execution !/usr/bin/perl Dokeos LMS = 1.8.5 "include" Remote Code Execution Exploit Description --------------------------------------------------------------- Dokeos LMS contains one flaw that allows an attacker to include a local file with "html" extension...

Dokeos Lms 1.8.5 - 'Include' Remote Code Execution

!/usr/bin/perl Dokeos LMS = 1.8.5 "include" Remote Code Execution Exploit Description --------------------------------------------------------------- Dokeos LMS contains one flaw that allows an attacker to include a local file with "html" extension. The issue is due to 'userportal.php' script not...

Dokeos LMS 1.8.5 PHP Code Injection

striptags$el2'; 108. break; 109. case SORTSTRING : 110. $comparefunction = 'strnatcmpTableSort::orderingstringstriptags$el1...

Dokeos LMS <= 1.8.5 (whoisonline.php) PHP Code Injection Exploit

Exploit for unknown platform in category web applications ================================================================ Dokeos LMS = 1.8.5 whoisonline.php PHP Code Injection Exploit ================================================================ ?php /...