Dokeos Multiple Directory Traversal Vulnerabilities
BID:14563
Info
Dokeos Multiple Directory Traversal Vulnerabilities
| Bugtraq ID: | 14563 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 15 2005 12:00AM |
| Updated: | Aug 15 2005 12:00AM |
| Credit: | Robbe De Keyzer is credited with the discovery of this vulnerability. |
| Vulnerable: |
Dokeos Open Source Learning & Knowledge Management Tool 1.6 RC2 Dokeos Open Source Learning & Knowledge Management Tool 1.5.5 Dokeos Open Source Learning & Knowledge Management Tool 1.5.4 Dokeos Open Source Learning & Knowledge Management Tool 1.5.3 Dokeos Open Source Learning & Knowledge Management Tool 1.5 Dokeos Open Source Learning & Knowledge Management Tool 1.4 |
| Not Vulnerable: | |
Discussion
Dokeos Multiple Directory Traversal Vulnerabilities
Dokeos is prone to multiple directory traversal vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
The problems present themselves when an attacker passes a name for a target file, along with directory traversal sequences, to the affected application through any of the affected parameters.
An attacker may leverage these issues to delete or move arbitrary files on an affected computer. Exploitation of this vulnerability could lead to a loss of integrity and possibly loss of availability.
To exploit these vulnerabilities an attacker must have successfully authenticated to the vulnerable application with course administration privileges (e.g. teachers).
Dokeos is prone to multiple directory traversal vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
The problems present themselves when an attacker passes a name for a target file, along with directory traversal sequences, to the affected application through any of the affected parameters.
An attacker may leverage these issues to delete or move arbitrary files on an affected computer. Exploitation of this vulnerability could lead to a loss of integrity and possibly loss of availability.
To exploit these vulnerabilities an attacker must have successfully authenticated to the vulnerable application with course administration privileges (e.g. teachers).
Exploit / POC
Dokeos Multiple Directory Traversal Vulnerabilities
No exploit is required.
No exploit is required.
Solution / Fix
Dokeos Multiple Directory Traversal Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.