ID CVE-2005-1375
Summary Multiple SQL injection vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to execute arbitrary SQL commands via (1) learningPath.php, (2) learningPathAdmin.php, (3) learnPath_details.php, (4) modules_pool.php, (5) module.php, (6) uInfo parameter in userInfo.php, or (7) exo_id parameter to exercises_details.php.
References
Vulnerable Configurations
  • cpe:2.3:a:claroline:claroline:1.5.3:*:*:*:*:*:*:*
    cpe:2.3:a:claroline:claroline:1.5.3:*:*:*:*:*:*:*
  • cpe:2.3:a:claroline:claroline:1.6_beta:*:*:*:*:*:*:*
    cpe:2.3:a:claroline:claroline:1.6_beta:*:*:*:*:*:*:*
  • cpe:2.3:a:claroline:claroline:1.6_rc1:*:*:*:*:*:*:*
    cpe:2.3:a:claroline:claroline:1.6_rc1:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 11-07-2017 - 01:32)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 13407
bugtraq 20050427 ZRCSA-200501 - Multiple vulnerabilities in Claroline
confirm http://www.claroline.net/news.php#85
sectrack 1013822
secunia
  • 15161
  • 15725
xf claroline-multiple-sql-injection(20298)
Last major update 11-07-2017 - 01:32
Published 03-05-2005 - 04:00
Last modified 11-07-2017 - 01:32
Back to Top