Search...

Claroline 1.5/1.6 toolaccess_details.php tool Parameter XSS

2014-07-01T00:00:00

ID SSV:79210
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00

Description

No description provided by source.

                                        
                                            
                                                source: http://www.securityfocus.com/bid/13407/info

Multiple remote input validation vulnerabilities affect Claroline e-Learning Application. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical application functionality such as database interaction and generating dynamic Web content.

Multiple cross-site scripting, SQL injection, directory traversal, and remote file include vulnerabilities have been reported.

An attacker may exploit these issues to manipulate SQL queries to the underlying database, have arbitrary script code executed in the browser of an unsuspecting user, and execute arbitrary server-side scripts with the privileges of an affected Web server. This may facilitate the theft of sensitive information, potentially including authentication credentials, data corruption, and a compromise of the affected computer.

**Update: Dokeos, which is based on claroline source code, is also prone to come of these issues. 

http:///www.example.com/claroline/tracking/toolaccess_details.php?tool=%3Cscript%3Ealert(&#39;xss&#39;);%3C/script%3E

JSON Vulners Source

Initial Source

{"lastseen": "2017-11-19T15:04:37", "modified": "2014-07-01T00:00:00", "description": "No description provided by source.", "cvss": {"score": 0.0, "vector": "NONE"}, "published": "2014-07-01T00:00:00", "status": "cve,poc", "enchantments": {"score": {"value": 0.2, "vector": "NONE", "modified": "2017-11-19T15:04:37", "rev": 2}, "dependencies": {"references": [], "modified": "2017-11-19T15:04:37", "rev": 2}, "vulnersScore": 0.2}, "href": "https://www.seebug.org/vuldb/ssvid-79210", "references": [], "enchantments_done": [], "id": "SSV:79210", "title": "Claroline 1.5/1.6 toolaccess_details.php tool Parameter XSS", "bulletinFamily": "exploit", "reporter": "Root", "cvelist": [], "viewCount": 6, "sourceData": "\n source: http://www.securityfocus.com/bid/13407/info\r\n\r\nMultiple remote input validation vulnerabilities affect Claroline e-Learning Application. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical application functionality such as database interaction and generating dynamic Web content.\r\n\r\nMultiple cross-site scripting, SQL injection, directory traversal, and remote file include vulnerabilities have been reported.\r\n\r\nAn attacker may exploit these issues to manipulate SQL queries to the underlying database, have arbitrary script code executed in the browser of an unsuspecting user, and execute arbitrary server-side scripts with the privileges of an affected Web server. This may facilitate the theft of sensitive information, potentially including authentication credentials, data corruption, and a compromise of the affected computer.\r\n\r\n**Update: Dokeos, which is based on claroline source code, is also prone to come of these issues. \r\n\r\nhttp:///www.example.com/claroline/tracking/toolaccess_details.php?tool=%3Cscript%3Ealert('xss');%3C/script%3E\n ", "sourceHref": "https://www.seebug.org/vuldb/ssvid-79210", "type": "seebug"}